VG Berlin - 1 K 187/21
| VG Berlin - 1 K 187/21 | |
|---|---|
 | |
| Court: | VG Berlin (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 15(1) GDPR |
| Decided: | 06.02.2024 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 1 K 187/21 |
| European Case Law Identifier: | ECLI:DE:VGBE:2024:0206.1K187.21.00 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Juris (in German) |
| Initial Contributor: | Julia |
The Administrative Court of Berlin held that it is not sufficient for the controller to provide only an abstract overview of the categories of personal data and the data recipients following an access request as the data subject cannot review the lawfulness of the data processing.
English Summary
Facts
On 20 October 2020, the data subject requested information regarding his personal data stored by the data controller and requested copies of all records containing this data. In a letter from 18 November 2020, the controller provided the data subject with general information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it. Moreover, the controller stated that although the data subject is not entitled to receive copies of all documents in which his personal data is mentioned, copies will be made available to the data subject if he specifies his request for information and describes which documents or processing activities he was concerned with.
In a letter from 4 December 2020, the data subject argued that the information provided was late and incomplete as it only listed in a specific way his so-called 'master data' ('Stammdaten'), whereas the data subject asserted a right to receive copies of all documents held by the data controller in which his personal data was listed. He additionally requested from the controller to erase all of his personal data and in the case of no erasure, the data subject objected to further processing of his personal data.
In a letter from 28 December 2020, the controller informed the data subject that it could not erase his personal data and rejected the data subject's objection to further processing. The controller reiterated that further copies will only be made available if the data subject specifies his request.
On 15 March 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin). The controller complied with the request for erasure after the filing of the lawsuit and therefore the parties agreed that this part of the lawsuit was settled. However, the data subject still requested the controller to provide him with all information on his personal data and to provide him with a complete copy of his personal data. The data subject claimed that under the GDPR he is entitled to receive copies of all documents held by the controller containing his personal data. The purpose of the request was to obtain a complete and unfiltered impression of the personal data held by the data controller and to be able to subsequently check whether the processing of the data was lawful.
The controller argued that the case should be dismissed as it was of the opinion that the provided information following the data subject's request was complete. Moreover, it argued that providing all documents would involve a disproportionate effort and therefore the request was unreasonable and constituted an abuse of rights, especially since the data subject did not specify the claim for information. The controller claimed it would have to review over 5,000 of pages and check whether the rights of third parties would be infringed by handing them over to the data subject.
Holding
The Court highlighted that the purpose of the right of access under Article 15(1) GDPR, as indicated, among other places, in Recital 63, is to enable data subjects to be aware of the processing of their personal data, thereby allowing them to subsequently verify not only the accuracy of this data but also the lawfulness of its processing. Therefore, the Court agreed with the data subject that in order to review the lawfulness of the data processing, a mere abstract overview of the processed data is not sufficient. which in this case was that the data subject only received information that covered the master data stored in the data controller's IT systems. In order for the data subject to be able to review the lawfulness of the data processing in each individual case, the Court held that it is necessary to be informed of the specific context in which the data was processed.
The Court acknowledged that responding to Article 15(1) GDPR requests entails a substantial effort for controllers. However, due to the importance of the - generally unconditional - right to information under Article 15(1) GDPR, a refusal by the controller to comply with a request for information due to the disproportionately high effort required for its fulfillment is only permissible in strictly limited exceptional cases. The Court held that this might occur in cases of an obviously significant disparity between the efforts required to fulfill the right to information and the interests of the data subject. However, the Court found that this is not the case here as the data subject wanted to understand how the controller passed on personal data to third parties in order to possibly assert the erasure or restriction of the processing of the data against these third parties. This can only be taken into account by handing over copies of the relevant documents to the data subject; an abstract overview of the recipients of the data is not sufficient. Against this background, the objection of abuse of rights, which is subject to equally strict requirements, also did not apply.
The Court concluded that the controller was obliged to provide the data subject with information about the data subject's personal data processed and a copy of this data.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
If you see this message, you do not have JavaScript activated in your browser. Please activate JavaScript to use the citizen service.
