VG Berlin - 1 K 187/21: Difference between revisions

From GDPRhub
mNo edit summary
mNo edit summary
Line 62: Line 62:
}}
}}


The Administrative Court of Berlin held that the controller providing only an abstract overview of the data recipients is not sufficient under a right of access as the data subject cannot review the lawfulness of the data processing.
The Administrative Court of Berlin held that it is not sufficient for the controller to provide only an abstract overview of the categories of personal data and the data recipients following an access request as the data subject cannot review the lawfulness of the data processing.


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
In October 2020,  the data subject requested information regarding his personal data stored by the data controller and requested copies of all records containing this data. In a letter from November 2020, the controller provided the data subject with information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it.
On 20 October 2020,  the data subject requested information regarding his personal data stored by the data controller and requested copies of all records containing this data. In a letter from 18 November 2020, the controller provided the data subject with information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it.


After receiving the controller's letter, the data subject argued that the information provided is incomplete as it only listed his so-called master data ('Stammdaten'), whereas he asserted a right to receive copies of all documents held by the data controller in which his personal data is listed. He additionally demanded from the controller to delete all of his personal data. The data controller was of the opinion that the provided information following the data subject's request was complete.  
In a letter from 4 December 2020, the data subject argued that the information provided was late and incomplete as it only listed his so-called master data ('Stammdaten'), whereas he asserted a right to receive copies of all documents held by the data controller in which his personal data is listed. He additionally requested from the controller to delete all of his personal data.
 
In a letter from 28 December 2020, the data controller informed the data subject that it could not delete the electronically stored personal data of the data subject as this was part of a file inventory and could only be deleted after the retention period expires.
 
The data controller was of the opinion that the provided information following the data subject's request was complete.  


Subsequently, the data subject claimed that, that under the GDPR he is entitled to receive copies of all documents held by the controller containing his personal data. On March 15, 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin).
Subsequently, the data subject claimed that, that under the GDPR he is entitled to receive copies of all documents held by the controller containing his personal data. On March 15, 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin).

Revision as of 13:00, 26 March 2024

VG Berlin - 1 K 187/21
Courts logo1.png
Court: VG Berlin (Germany)
Jurisdiction: Germany
Relevant Law: Article 15 GDPR
Article 15(1) GDPR
Decided: 06.02.2024
Published:
Parties:
National Case Number/Name: 1 K 187/21
European Case Law Identifier: ECLI:DE:VGBE:2024:0206.1K187.21.00
Appeal from:
Appeal to: Unknown
Original Language(s): German
Original Source: Juris (in German)
Initial Contributor: Julia

The Administrative Court of Berlin held that it is not sufficient for the controller to provide only an abstract overview of the categories of personal data and the data recipients following an access request as the data subject cannot review the lawfulness of the data processing.

English Summary

Facts

On 20 October 2020, the data subject requested information regarding his personal data stored by the data controller and requested copies of all records containing this data. In a letter from 18 November 2020, the controller provided the data subject with information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it.

In a letter from 4 December 2020, the data subject argued that the information provided was late and incomplete as it only listed his so-called master data ('Stammdaten'), whereas he asserted a right to receive copies of all documents held by the data controller in which his personal data is listed. He additionally requested from the controller to delete all of his personal data.

In a letter from 28 December 2020, the data controller informed the data subject that it could not delete the electronically stored personal data of the data subject as this was part of a file inventory and could only be deleted after the retention period expires.

The data controller was of the opinion that the provided information following the data subject's request was complete.

Subsequently, the data subject claimed that, that under the GDPR he is entitled to receive copies of all documents held by the controller containing his personal data. On March 15, 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin).

Holding

In the judgment, the Court highlighted the purpose of the right to information under Article 15(1) GDPR, as indicated, among other places, in Recital 63, is to enable data subjects to be aware of the processing of their personal data, thereby allowing them to subsequently verify not only the accuracy of this data but also the lawfulness of its processing. Therefore, the Court agreed with the data subject that in order to review the lawfulness of the data processing, a mere abstract overview of the processed data is not sufficient as it was present in the case at hand when the data subject only received information that covered the master data stored in the data controller's IT systems. Rather, in order to be able to verify the lawfulness of the data processing in each individual case, the Court held that it is necessary to provide specific information on the context in which the data was processed.

The Court acknowledged that responding to Article 15(1) GDPR requests is combined with a substantial effort for controllers. However, due to the importance of the - generally unconditional - right to information under Article 15(1) GDPR, a refusal by the controller to comply with a request for information due to the disproportionately high effort required for its fulfillment is only permissible in strictly limited exceptional cases. The court held that this might occur in cases of an obviously significant disparity between the efforts required to fulfill the right to information and the information interest of the data subject. However, the Court found that this is not the case as the data subject wants to understand how the controller passed on personal data to third parties in order to possibly assert the deletion or restriction of the processing of the data against these third parties. This can only be taken into account by the controller handing over copies of the relevant documents to the data subject; an abstract overview of the recipients of the data is not sufficient. Against this background, the objection of abuse of rights, which is subject to equally strict requirements also did not apply.

The Court concluded that the controller is obliged to provide the data subject with information about the data subject's personal data processed by providing a copy of this data.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

If you see this message, you do not have JavaScript activated in your browser. Please activate JavaScript to use the citizen service.