BGH - VI ZR 223/21
From GDPRhub
| BGH - VI ZR 223/21 | |
|---|---|
 | |
| Court: | BGH (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15(1) GDPR Article 15(3) GDPR |
| Decided: | 16.04.2024 |
| Published: | 16.04.2024 |
| Parties: | |
| National Case Number/Name: | VI ZR 223/21 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Openjur (in German) |
| Initial Contributor: | Mgrd |
The Federal Court of Justice ordered an insurance company to disclose and share the requested personal data with the data subject in relation to the termination of his contract.
English Summary
Facts
In April 2019, following Article 15 GDPR, the data subject requested access to his personal data from an insurance company related to a terminated pension insurance contract that was initiated in 2004 and settled by 2017. The information included transcripts of statements and copies of data from the contract in order to be able to examine a possible right of withdrawal.
The controller provided the personal data it had stored (name, address, date of birth, email address, bank details, nationality, marital status, health data) and financial details like the total contributions paid, but the data subject considered it was insufficient, particularly regarding specific data and documentation related to the insurance dealings. The data subject requested the following data:
- the statements made by the controller to the data subject (letters of termination, statements and enquiries regarding the contract, statements regarding the state of health);
- the statements made by the controller to the data subject or to third parties (insurance certificate with supplements, cover letters, termination letters, payment reminders, settlement letters, notifications about the status of the contract);
- accounting data for each incoming and outgoing payment stored in relation to the data subject's insurance contract; and
- the fund profits achieved, the amount of the administration, distribution and acquisition costs deducted from the data subject's insurance premium, the capital at risk, the probability of loss occurrence and/or the actual value of the risk protection.
In 2020, the Regional Court of Stuttgart (Landgericht Stuttgart - LG Stuttgart) dismissed the claim because there was no entitlement to further information than that already provided. In 2021, upon appeal by the data subject, the Higher Regional Court of Stuttgart (Oberlandesgerichts Stuttgart - OLG Stuttgart) partially amended the Regional Court’s judgment and ordered the controller to provide the data subject with information about statements and transactions, and awarded partial reimbursement for the data subject legal costs.
The case was then appealed to the Appeal Court with regard to the rejected claim for transcripts and copies. The data subject is pursuing his request to the extent of the appeal being dismissed, with the proviso that with regard to the request for information under item "4" (fund profits achieved, etc.), the data subject is now requesting the transmission of copies of the more precisely specified data directly, i.e. not as previously by way of a staged action. In the alternative, the data subject has applied in the Appeal instance for copies of the personal data contained in the documents to be sent to him.
Holding
The German Federal Court of Justice (Bundesgerichtshof – BGH) held that the data subject is entitled to request additional information under Article 15(1) GDPR, specifically copies of statements he made to the controller. However, the court limited this right to personal data, excluding internal processes of the controller that do not directly concern the data subject, such as internal financial calculations and risk assessments which were deemed not to be personal data.
Furthermore, the Court found that the data subject does not have rights to the more detailed data he sought referred to fund profits and risk assessments, as these do not constitute personal data under GDPR. BGH also clarified that the right to a copy under Article 15(3) GDPR does not extend beyond the scope of Article 15(1), meaning the data subject is only entitled to copies of his personal data, not other documents or data beyond this.
The decision also stated that the data subject's claims for copies of data do not arise from Section 3 of the Insurance Contracts Act (VVG), as the insurance relationship had been fully terminated and settled. As such, these rights no longer apply.
The Court also found that the Regional Court incorrectly denied the data subject's right to receive copies of statements made by the controller and booking data related to the data subject's contract and transactions, these should be reassessed and was referred back to the Appeal Court for a new hearing and decision.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
On the right to information under Art. 15 (1) and (3) GDPR (following the Senate judgment of March 5, 2024 - VI ZR 330/21).
Tenor
In response to the plaintiff's appeal, the judgment of the 7th Civil Senate of the Stuttgart Higher Regional Court of June 17, 2021 is partially overturned in terms of costs and in this respect, and the judgment of the Stuttgart Regional Court of November 4, 2020 is partially amended insofar as it was decided to the detriment of the plaintiff.
The defendant is also ordered to provide the plaintiff with copies of the statements made by the plaintiff to the defendant that are in the defendant's possession (request for information under a).
To the extent that the plaintiff requests the provision of copies of the statements made by the defendant to the plaintiff or to third parties (insurance certificate with addendums, cover letters, termination letters, payment reminders, settlement letters, notifications about the status of the contract; request for information under b) as well as booking data for each incoming and outgoing payment stored in relation to the plaintiff's insurance contract (request for information under c), and to the extent that it requests further reimbursement of pre-trial legal costs related to the requests for information under a, b and c, the matter is referred back to the appeal court for a new hearing and decision, including on the entire costs of the appeal proceedings.
The further action is dismissed.
The plaintiff's further legal remedies are rejected.
As a matter of law
Facts
The plaintiff requests information, copies of statements and copies of data from an insurance contract from the defendant insurer in order to be able to check a possible right of withdrawal.
There was a contract between the parties for a unit-linked pension insurance policy concluded in 2004, which was terminated in 2016 and settled in 2017. In April 2019, the plaintiff requested information from the defendant on stored personal data and documents relating to the insurance contract in accordance with Art. 15 GDPR. The defendant informed the plaintiff of the personal data it had stored (name, address, date of birth, email address, bank details, nationality, marital status, health data) as well as the total amount of contributions paid and sent a copy of the insurance application. The plaintiff considers this to be insufficient and requests information about the storage of
a) the statements made by the plaintiff to the defendant (letters of termination, statements and inquiries about the contract, statements about the state of health),
b) the statements made by the defendant to the plaintiff or to third parties (insurance certificate with addendums, cover letters, letters of termination, payment reminders, settlement letters, notifications about the status of the contract),
c) booking data for each incoming and outgoing payment stored in relation to the plaintiff's insurance contract,
d) the fund profits achieved, the amount of the administrative, sales and acquisition costs deducted from the plaintiff's insurance premium, the capital at risk, the probability of the occurrence of damage and/or the actual value of the risk protection,
as well as the transmission of the plaintiff's statements in copy and the other data in copy.
The regional court dismissed the action because there was no entitlement to further information than that already provided. Following the plaintiff's appeal, the Higher Regional Court partially amended the Regional Court's ruling and ordered the defendant to provide the plaintiff with information about the storage of
a) the statements made by the plaintiff to the defendant (letters of termination, statements and inquiries about the contract, statements about the state of health),
b) the statements made by the defendant to the plaintiff or to third parties (insurance certificate with addendums, statements about the contract, payment reminders, settlement letters, notifications about the status of the contract),
c) booking data for every incoming and outgoing payment stored in relation to the plaintiff's insurance contract.
It also awarded the plaintiff partial reimbursement of its pre-trial legal costs. It dismissed the rest of the action. With the appeal allowed by the appeal court with regard to the rejected claim for transcripts and copies, the plaintiff is pursuing her request to the extent of the appeal rejection, with the proviso that with regard to the request for information on d (fund profits achieved, etc.), she now requests the transmission of copies of the specified data directly, i.e. not as previously by way of a staged action. In the alternative, the plaintiff has requested in the appeal instance that copies of the personal data contained in the documents be sent to her.
By order of May 31, 2022, the Senate suspended the proceedings in accordance with Section 148 of the Code of Civil Procedure until a decision by the Court of Justice of the European Union in cases C-487/21 and C-307/20.
Reasons
I.
In the opinion of the Court of Appeal (BeckRS 2021, 54382), the plaintiff can only request the additional information granted under Article 15 (1) GDPR, but not the requested transcripts and copies, nor information on the points requested under d. With regard to this request for information, it is not information regarding the storage of the plaintiff's personal data, but rather internal processes at the defendant that have no connection whatsoever with the plaintiff and do not allow any conclusions to be drawn about the plaintiff. Fund profits, costs, premiums and capital are not assets assigned to the plaintiff. The capital at risk, the value of the risk protection and the probability of damage occurring are also not information about a natural person, but internal calculation factors of the defendant.
The plaintiff also has no claim against the defendant to receive a copy of the respective declaration (request for information under a) or a copy of this data (request for information under b-d). The right to a copy under Article 15 (3) GDPR does not go any further than the obligation to provide information under Article 15 (1) GDPR. The person concerned is therefore only entitled to a copy of the personal data, but not to information beyond the personal data.
The claims sought do not arise from Section 3 of the Insurance Contract Act. If the insurance relationship has been terminated and completely wound up, a claim under Section 3 (3) sentence 1 of the Insurance Contract Act is no longer possible.
II.
These considerations do not fully stand up to review under the law of appeal. The plaintiff's appeal is justified insofar as it demands the provision of copies of the statements stored by the defendant and written by the plaintiff herself (under 1.). On the basis of the findings to date, the appeal court wrongly denied the plaintiff's claim with regard to the statements made by the defendant and with regard to the booking transactions (under 2.). Otherwise, the appeal is unfounded (under 3.).
1. The plaintiff is entitled under Article 15 (1) and (3) GDPR to be provided with copies of the statements written by the defendant that are stored by the plaintiff (request for information under a).
a) Article 15 GDPR is applicable in terms of time. The General Data Protection Regulation also applies to processing operations that were carried out before May 25, 2018, the date of application of the General Data Protection Regulation (Article 99 (2) GDPR), if the request for information was made after that date (see ECJ, judgment of June 22, 2023 - C-579/21, NJW 2023, 2555 para. 36). According to the findings of the appeal court, the plaintiff requested information and copies from the defendant in a letter dated April 3, 2019.
b) Article 15 (1) GDPR gives the data subject a right to information about the processing of personal data from the data protection controller (Article 4 No. 7 GDPR). Article 15 (3) GDPR sets out the practical modalities for fulfilling the obligation incumbent on the data protection controller by, among other things, determining the form in which the personal data must be made available, namely in the form of a "copy" of the data, but does not grant any right other than that provided for in Article 15 (1) GDPR (Senate judgment of March 5, 2024 - VI ZR 330/21, juris para. 14; cf. ECJ, judgment of May 4, 2023 - C-487/21, NJW 2023, 2253 para. 31 et seq.).
c) According to Art. 4 No. 1 GDPR, personal data is all information relating to an identified or identifiable natural person ("data subject"). According to the case law of the Court of Justice of the European Union, the term is to be understood broadly. It is not limited to sensitive or private information, but potentially includes all types of information of both an objective and subjective nature, provided that it is information about the person in question. The latter requirement is met if the information is linked to a specific person due to its content, purpose or effects (cf. ECJ, judgment of 4 May 2023 - C-487/21, NJW 2023, 2253 para. 23 et seq.; Senate judgment of 15 June 2021 - VI ZR 576/19, NJW 2021, 2726 para. 22 with further references).
According to these principles, letters from the data subject to the controller are to be classified as personal data in their entirety, since the personal information already consists in the fact that the data subject has expressed himself in accordance with the letter, but conversely, letters from the controller to the data subject only to the extent that they contain information about the data subject in accordance with the above-mentioned criteria (cf. Senate judgments of March 5, 2024 - VI ZR 330/21, juris para. 16; of February 6, 2024 - VI ZR 15/23, WM 2024, 555 para. 8; of June 15, 2021 - VI ZR 576/19, NJW 2021, 2726 para. 25; BGH, judgment of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490 para. 48). The fact that these letters are already known to the person concerned does not exclude the right to information under data protection law (see Senate judgment of 15 June 2021 - VI ZR 576/19, NJW 2021, 2726 para. 25 with further references).
d) Accordingly, the statements written by the plaintiff, which are available to the defendant (request for information under a), constitute personal data in their entirety, which is why the plaintiff can ultimately request a copy of these statements under Art. 15 (3) GDPR, even if the term copy in this provision does not refer to a document as such, but to the personal data it contains (see ECJ, judgments of 26 October 2023 - C-307/22, NJW 2023, 3481 para. 72; of 4 May 2023 - C-487/21, NJW 2023, 2253 para. 32). This is because the copy must contain all personal data that are the subject of the processing (cf. ECJ, judgments of October 26, 2023 - C-307/22, NJW 2023, 3481, para. 73; of May 4, 2023 - C-487/21, NJW 2023, 2253, para. 32, 39). The completeness of the information can only be satisfied here by a copy of the entire document (Senate judgment of March 5, 2024 - VI ZR 330/21, juris para. 17).
2. The appeal is also at least provisionally successful insofar as the plaintiff requests copies of the defendant's statements (request for information under b) and the booking transactions concerning her (request for information under c).
a) On the basis of the findings to date, the corresponding claim under Art. 15 (1) and (3) GDPR cannot be denied.
aa) The applications still pursued by the plaintiff in the appeal, which are to be interpreted as procedural statements by the appeal court itself (cf. Senate judgment of June 29, 2021 - VI ZR 52/18, NJW 2021, 3130, para. 16 with further references), are aimed at providing the plaintiff with copies of all statements made by the defendant (request for information under b) as well as all booking transactions relating to the plaintiff's contract (request for information under c) which are available to the defendant and which contain information about the plaintiff. According to the statement of reasons for the action, which must be used to determine the claim (see Senate judgment of June 15, 2021 - VI ZR 576/19, NJW 2021, 2726, marginal no. 32 with further references), the plaintiff is requesting the release of a copy of the documents containing personal data concerning her. Contrary to the wording of her claim ("copy of the data"), the plaintiff is thus not only requesting copies of the personal data contained in the aforementioned document categories, but copies of these documents. The statement of reasons for the appeal supports this understanding by stating that the right to information relates to the content of the documents and files in which the plaintiff's personal data is stored. The plaintiff should therefore be granted copies of the documents in question - as with the statements she herself wrote - with other components being allowed to be made unrecognizable in the copy. If the interpretation were more narrow, limited to the transmission of a copy of the personal data, the auxiliary applications made in the appeal proceedings, which now make this restriction, would also make no sense.
bb) Neither the statements addressed by the defendant to the plaintiff or even to third parties nor the entire booking process necessarily constitute personal data of the plaintiff, even if they may contain information about the plaintiff. It is conceivable that letters from the defendant to the plaintiff and individual booking processes contain only information about the plaintiff. However, it cannot be assumed that this is the case in all cases. Therefore, the requirement to provide complete information about personal data does not, in principle, give the plaintiff any right to have all of these documents provided as a copy, as requested by the plaintiff, even if partially blacked out (see Senate judgments of March 5, 2024 - VI ZR 330/21, juris para. 18; of February 6, 2024 - VI ZR 15/23, WM 2024, 555 para. 9 et seq.).
cc) However, the reproduction of extracts from documents or even entire documents or even extracts from databases may prove indispensable, regardless of the need to provide complete information, if the contextualisation of the data processed is necessary to ensure their comprehensibility and to ensure that the data subject can effectively exercise his or her rights (see ECJ, judgments of 4 May 2023 - C-487/21, NJW 2023, 2253 paras. 41, 45; of 22 June 2023 - C-579/21, NJW 2023, 2555 para. 66; of 26 October 2023 - C-307/22, NJW 2023, 3481 paras. 74 et seq.; Senate judgments of 5 March 2024 - VI ZR 330/21, juris para. 18; of February 6, 2024 - VI ZR 15/23, WM 2024, 555 para. 10; BGH, judgment of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490 para. 54 et seq.). The plaintiff did not submit any arguments on this point in the lower courts. However, since the criterion of the necessary contextualization is a new legal aspect that only became relevant due to the case law of the Court of Justice of the European Union issued during the appeal proceedings, the plaintiff must be given the opportunity, as she requested, to comment on this in addition and to present her arguments further, for reasons of procedural fairness (cf. BGH, judgments of 12 January 2017 - I ZR 253/14, MMR 2017, 394, para. 108; of 5 February 2015 - I ZR 240/12, K&R 2015, 326, para. 55).
b) However, the requested right to the delivery of copies does not arise from Section 3 VVG.
aa) According to Section 3 Paragraph 3 VVG, the policyholder can indeed request the insurer to issue a new insurance policy if an insurance policy has been lost or destroyed. The other documents in dispute are not covered by this anyway. But even if the plaintiff has requested that the insurance certificate and supplements to it be made available to her, this cannot be based on Section 3 (3) VVG. The insurance certificate has an information, legitimation and evidential function. So that the policyholder can inform himself about the rights and obligations arising from the contract and prove them, Section 3 (3) VVG gives him the right to have a replacement insurance certificate issued. This therefore only covers the insurance certificate including those supplements that reflect the currently valid contract content, but not supplements that are already outdated (BGH, judgments of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490 para. 42; of February 21, 2024 - IV ZR 311/22, r+s 2024, 314 para. 16). In the case in dispute, however, the insurance was canceled in 2016 and settled in 2017.
Contrary to what the appeal claims, the claim under Section 3 Paragraph 3 of the Insurance Contract Act does not continue after the contractual relationship has ended, insofar as its proper processing is to be checked. In this respect, according to the will of the legislator, there is only a right to information on the content of the contractual provisions in accordance with Section 7 Paragraph 4 of the Insurance Contract Act (see BT-Drucks. 16/3945, p. 61), which, however, are not the subject of the present requests for information under b and c (see the concept of contractual provisions in Section 7 Paragraph 4 of the Insurance Contract Act: BGH, judgment of February 21, 2024 - IV ZR 311/22, r+s 2024, 314 Rn. 18 with further references).
bb) Section 3 (4) sentence 1 VVG only refers to the policyholder's own statements, not those of the insurer, and is therefore also ruled out as a basis for a claim (BGH, judgment of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490 marginal no. 43 with further references).
c) The requests for information under b and c cannot be based on Section 810 BGB either, since this provision only allows the inspection of a document in the possession of another person (BGH, judgment of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490 marginal no. 44 with further references).
d) Finally, the plaintiff cannot base the requests for information under b and c on good faith according to Section 242 BGB.
aa) However, according to Section 242 of the German Civil Code (BGB), the debtor is exceptionally obliged to provide information within the framework of a legal relationship if the entitled party is justifiably uncertain about the existence and extent of his right and the obligated party can easily provide the information required to eliminate the uncertainty. The granting of the right to information must take into account the respective circumstances of the individual case and in compliance with the principle of proportionality. Within contractual relationships, the right to information can also have the function of providing the entitled party with information about the existence of the claim in principle. There must then be sufficient evidence of the existence of a main claim that is to be asserted with the help of the information (Senate judgment of February 6, 2024 - VI ZR 15/23, WM 2024, 555 para. 17; BGH, judgment of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490 para. 30 ff. with further references).
The entitled party must first demonstrate that he no longer has the documents specified in the request for information. Only then can it be established that he is uncertain about the existence and scope of his right and cannot reasonably obtain the necessary information himself. Good faith does not require that the person seeking information be spared effort at the expense of the person obliged to provide information (BGH, judgment of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490, para. 38 with further references). Finally, the reasons for the loss must be explained. The policyholder cannot be excused from being uncertain about his rights if he no longer has the documents in question and does not provide any further information on the reasons for the loss. Only the explanation of the reasons for the loss by the policyholder makes it possible to assess whether the policyholder, taking into account the respective circumstances of the individual case and observing the principle of proportionality, is exceptionally entitled to a right to information under Section 242 of the German Civil Code (BGB) (Senate judgment of February 6, 2024 - VI ZR 15/23, WM 2024, 555 para. 19; cf. BGH, judgment of September 27, 2023 - IV ZR 177/22, NJW 2023, 3490 para. 40 with further references).
bb) According to these principles - which are not new in contrast to the question of the necessary contextualization in the context of the claim under Section 15 Paragraph 1 and Paragraph 3 GDPR (above II.2.a.cc) - the requirements for a claim under Section 242 of the German Civil Code have not been sufficiently demonstrated. Neither the findings of the appeal court nor the minutes of the appeal hearing indicate that the plaintiff made a corresponding statement. The appeal also does not show that the appeal court ignored the plaintiff's submissions in this regard.
3. In contrast, the appeal in the main and auxiliary applications remains unsuccessful insofar as the plaintiff requests further information (request for information on d: fund profits achieved, amount of the administrative, sales and acquisition costs deducted from the plaintiff's insurance premium, capital at risk, probability of damage occurring and/or the actual value of the risk protection).
a) For a claim based on Article 15(1) and (3) GDPR, as the appeal court correctly stated, the information requested does not have the necessary personal reference. Contrary to what the appeal claims, this information is not assigned to all of the insured persons under data protection law, so that the corresponding data would be personally related to the plaintiff to the extent of the fund assets.
b) As already explained (above II.2.b, c and d), further grounds for the claim are not possible, including with regard to the request for information under d.
III.
The matter must therefore be referred back to the appeal court to the extent of the annulment in accordance with Section 563(1) sentence 1 of the Code of Civil Procedure, so that the court can give the plaintiff the opportunity to make additional statements on the aspect of contextualization within the framework of the claim based on Article 15(1) and (3) GDPR.
Seiters
von Pentz
Müller
Klein
Allgayer
