OVG Münster - 16 A 1582/21
| OVG Münster - 16 A 1582/21 | |
|---|---|
 | |
| Court: | OVG Münster (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 12(5) GDPR Article 15(3) GDPR § 5(8)(1) DSG NRW § 23(2) JAG NRW |
| Decided: | 08.06.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 16 A 1582/21 |
| European Case Law Identifier: | ECLI:DE:OVGNRW:2021:0608.16A1582.20.00 |
| Appeal from: | VG Gelsenkirchen 20 K 6392/18 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | de/nrwe/ovgs/ovg_nrw/j2021/16_A_1582_20_Urteil_20210608.html NRWE Rechtsprechungsdatenbank (in German) |
| Initial Contributor: | n/a |
A German court ruled that an examinee has a right to be provided with a free copy of the exams he wrote in the context of the second state law examination, including the examiners’ reports. In particular, the court held that the right to a free copy is independent and distinct from the right to information under Article 15(1) GDPR (extensive interpretation).
English Summary
Facts
The plaintiff took his second state law examination in the state of North Rhine-Westphalia, which consists of a (hand-)written part and a later oral part. He successfully completed the exam and did not challenge the assessment of his examination performance. After the examination was completed, i.e. after the oral examination, he requested the defendant, the State Judicial Examination Office (Landesjustizprüfungsamt, “LJPA”) to send him the copies of his exams including the examiners’ opinions in electronic form or by post.
The LJPA stated that it would only agree to this for a fee of €69.70 to be paid in advance.
The claimant then renewed his claim and explicitly invoked Articles 15(3)(1) and 12(5) GDPR.
The defendant again rejected this. In particular, he pointed out that the material scope of application of the GDPR did not apply.
The plaintiff then filed an action. The court of first instance ruled in accordance with the application.
The defendant appealed against this, which is the subject of this summary.
Holding
The court dismissed the defendant's appeal. The court found that the defendant was obliged to provide the plaintiff with a copy of his exams prepared in the context of the second state law examination together with the examiners' reports in paper form or commonly used electronic form free of charge.
The court first ruled that the claim to the provision of a free copy of his examination papers prepared in the second state law examination together with the examiners’ reports follows from Articles 15(3)(1), 12(5)(1) GDPR in conjunction with § 5(8)(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW).
Applicability of Articles 15(3)(1), 12(5)(1) GDPR
The court first finds that Articles 15(3)(1), 12(5)(1) GDPR apply. However, it leaves open whether the material scope of application of the GDPR is opened or not opened due to Article 2(2)(a) GDPR. In any case, the applicability follows from § 5(8)(1) DSG NRW. According to this provision, the provisions of the GDPR shall apply mutatis mutandis to processing operations that do not fall within the scope of Union law, unless this Part or other specific legal provisions contain deviating regulations.
In the court's view, these applicability requirements were met: (1) personal data were processed (2) partially automatically and (3) there were no deviating regulations.
Exams and Examiners' Reports as Personal Data
The first condition, i.e. the qualification of the exams and the examiners' reports as personal data within the meaning of Article 4(1) GDPR, was accepted, taking into account the broad case law of the CJEU. This was not precluded by the fact that the individual examiner cannot verify the identity of the individual examinee. There is only a pseudonymised identification number on the exams. By means of this, however, the LJPA can undoubtedly identify the examinee again with the help of separately stored information.
Processing of Personal Data Partly by Automated Means, Article 2(1) GDPR
The court swiftly found that processing within the meaning of Article 4(2) GDPR is in any case to be seen in the fact that the supervisory work is kept (storage) and ordered (as a sub-case of organisation) at the LJPA. The court emphasises that a completely non-automated action is also sufficient for the concept of processing. Next, the court found that there was partially automated processing. The court stated that data processing is partially automated within the meaning of Article 2(1) GDPR if it is at least partially supported by information technology and is not completely manual, i.e. if even only one function of the entire processing operation is supported by information technology. This is the case, for example, if a file system can be accessed through an automated index. These requirements were met. Even if the exams, including the examiners’ reports, are manually assigned in paper form to the respective file of the examinee, it is still possible to find and assign them via electronic data processing by means of the respective code number.
No Deviating Regulations
The court then finds that there are no deviating regulations within the meaning of § 5(8)(1) DSG NRW. This does not apply, in particular, to § 23(2) the Legal Education Act of North Rhine Westphalia (JAG NRW), which stipulates that an examinee must be allowed access to the examination papers, including the examiners' reports, on the premises of the LJPA within one month of notification of the examination decision.
This is initially attributed to the wording of the provision, which does not relate to the transmission of a free copy and in this respect does not constitute a deviating regulation.
The meaning and purpose of the provision can also not justify a priority of application over Articles 15(3)(1), 12(5)(1) GDPR. § 23(2) JAG NRW does contain a right to information, but this does not pursue any data protection (regulatory) objectives. Rather, it aims to ensure the transparency of the examination procedure and the effectiveness of legal protection (avoidance of a possible objection or legal action). In contrast, the right under Article 15 GDPR consists of giving the data subject the opportunity to be or become aware of the processing of his or her personal data and to be able to review the lawfulness of the data processing (cf. Recitals 7 and 63 GDPR). In this respect, it is a matter of transparency and lawfulness control of data processing - in contrast to § 23 (2) JAG NRW. The fact that the provision of information pursuant to § 23(2) JAG NRW leads to the provision of the same information is irrelevant against this regulatory background.
A different interpretation cannot follow from the deadline regulation in § 23(2) JAG NRW. The time limit for inspection is 1 month and is thus just as long as the time limit for the respective examination challenge. In contrast, the claim under Articles 15(3)(1), 12(5)(1) GDPR must be exercisable for the duration of the processing, especially the data retention in order to effectively realise the data subject's rights under data protection law.
Finally, the court points out that the provisions of the law on fees, according to which €69.70 must be paid in the present case, cannot constitute a deviating regulation. Any other interpretation would obviously contradict the EU law provisions of Article 23(1) and (2) GDPR.
Independent Claim to Provision of a Copy Free of Charge
The court first addresses the dispute as to whether Articles 15(3)(1), 12(5)(1) GDPR constitute an independent claim to the provision of a free copy or only regulate a special form of the information claim under Article 15(1) GDPR, so that the claim to a copy would only exist to the extent of the claim to information. The court opts for the extensive interpretation and sees Articles 15(3)(1), 12(5)(1) GDPR as an independent claim. The broad concept of personal data underlying the GDPR (Article 4(1) GDPR), the wording and purpose of Article 15(3)(1) GDPR, as well as the history and systematics of the regulation speak against the restrictive interpretation.
According to the wording of Article 15(3)(1) GDPR, the data subject is entitled to "a copy of the personal data undergoing processing". The provision makes no reference to the information listed in paragraph 1, so there is no evidence of a limitation to such information. Since the wording refers to "personal data", it goes beyond the data and information listed in paragraph 1. Indeed, the “information” is not the personal data themselves, but other information relating to the processing of the data.
The use of the term "Gegenstand" (“subject matter”) in the German version also does not lead to a restrictive interpretation. The defendant interpreted this term restrictively as "subject" or "objective" and therefore thought that only an aggregated overview was owed. However, this was not convincing, as the term "Gegenstand" can also be understood as the content of a specific process, in this case data processing. This is confirmed with reference to the English version of the GDPR "a copy of the personal data undergoing processing".
The German word "eine" (which can mean either "a" or "one") does not support a restrictive reading either. This does not mean the numeral word "one" but only the indefinite article "a", which is again confirmed by the English version.
The court goes on to say that the meaning and purpose of the provision speak against a restrictive reading. In doing so, the court refers back to Article 8 CFR and Article 16(1) TFEU. Article 8(2)(2) CFR already enshrines the right of every person to obtain information and to have data rectified. The rights of data subjects under the GDPR are rooted in the European legislator's consideration that individuals must be able to decide for themselves on the disclosure and use of their personal data. The aim is for the data subject to be aware of the processing and, on this basis, to be able to review its lawfulness (cf. Recital 63 sentence 1 GDPR).
The court explained that this review also included the assessment of whether the data had been processed correctly in terms of content. Access to the data itself was necessary for this. This was also confirmed by Recital 63 sentence 4 GDPR, which postulates direct access by the data subject to his or her data. Access to the data itself also enables the assertion of further data subjects' rights ("necessary foundation of knowledge"). This is confirmed by reference to CJEU case law (C-553/07) on the predecessor provision in Directive 95/46/EC, in which the court emphasised the instrumental character of the right of access for the data subject's request that the controller correct, erase or block his or her data.
The interpretation is also not precluded by the claim under Article 20 GDPR, as this pursues a different objective, namely the provision of a format (and not a copy) that enables immediate further processing.
Finally, the court also addresses the history of the regulation, which does not speak in favour of a restrictive reading. The only point of reference for such a reading would be that Article 15 of the European Parliament legislative resolution of 12 March 2014 on the GDPR-proposal was initially titled "Right to access and to obtain data for the data subject" and after the conclusion of the legislative process was only titled "Right of access of the data subject". At the time of the legislative resolution, however, Article 15 only regulated the right to data portability (and not the provision of a copy). In this respect, no significance can be attached to this argument, as this right was finally regulated in Article 20 GDPR, where it is also only titled "Right to data portability".
A transposition of the CJEU case law in its judgment of 17 July 2014 - C-141/12, on Article 12(a) Directive 95/46/EC does not lead to a different result. In this decision, the CJEU had ruled that it was sufficient for the applicant to receive a complete overview of all personal data concerning him that were the subject of the processing in an intelligible form. However, this previous ruling did not contain a right to receive a copy of the data within the meaning of Article 15(3) GDPR and did not make any statement about such a right.
Insofar as the defendant further states that a transfer of the requested data would be unstructured and non-transparent and thus contradict the principle of Article 12(1)(2) GDPR ("intelligible form"). While the court is already unable to discern whether this assertion is correct, it points out that the cited provision serves to protect data subjects and that no restrictions on data subjects' rights can be derived from it.
An expansion of the scope of the claim is also not precluded. The legislator has recognised that claims for information may involve the processing of large amounts of data. This is responded to, for example, by the possibility of requesting a specification (Recital 63, sentence 7 GDPR) and by the possibility of extending the information deadline in Article 12(3)(2) GDPR.
Ultimately, the principle of data minimisation from Article 5(1)(c) GDPR does not stand in the way, as no new data is processed by creating the copies, but only existing data is duplicated. However, the copy is made available to the data subject - who is to be protected - at their request, without it having to remain with the controller.
No Exclusion by Other Provisions
The court then states that there is no discernible exclusion by other legal provisions.
No Conflicting Rights of the Examiners
First, an exclusion under Article 15(4) GDPR is rejected. In particular, no rights of the examiners would be opposed (trade secrets or intellectual property, cf. Recital 63, sentence 5 GDPR). This is justified by the fact that the corrections are made from the outset with the proviso that they are made available to the examinee upon request. Any other assessment would also contradict the guarantee of legal recourse (Article 19(4) of the German Constitution, GG), since the assessment must be accessible to review, which presupposes the prior knowledge of the examinee.
No Excessive Request
Also, Article 12(5)(2) GDPR does not preclude a claim, particularly in the absence of an excessive request. The excessiveness does not follow from the fact that the application comprises 348 pages to be copied. An application does not constitute excessive merely because of a high processing effort. Rather, what is required is the existence of abusive behaviour on the part of the claimant, which can be based, for example, on the harassing assertion of a data subject's right with the aim of damaging the controller.
The court already found that the unclipping and copying of the examinations together with the expert opinions did not constitute a disproportionate processing effort. In particular, it had to be clearly recorded which documents were involved and there was no need for the LJPA to first check whether the rights of third parties could be affected, as this was (obviously) not the case.
The LJPA's argument that there is a fear of a large number of requests and an associated increase in staff costs, a threatening cost burden and a jeopardisation of the examination procedure (2,500 examinees in this examination year; 12,500 in the past five examination years) is also irrelevant. This argument already lacks the necessary reference to an individual case in order to establish the abusive behaviour of the plaintiff.
The court leaves open whether the exceptional circumstances of Article 12(5)(2) GDPR also include cases in which the data subject pursues solely or predominantly non-privacy-related purposes in exercising the claim under Article 15(3)(1) GDPR. There are already no indications for the pursuit of purposes unrelated to data protection. This could only be due to the fact that the data protection claim allows a view into the examination procedure. In this case, however, this was only due to the fact that these claims existed side by side. In the present case, however, it was no longer possible to challenge the examinations under examination law.
No Analogous Application of Article 14(5)(b) variant 2 GDPR.
The court then held that the exception in Article 14(5)(b) variant 2 GDPR, according to which a disproportionate effort can lead to the inapplicability of Articles 14(1) to (4) GDPR and thus to the omission of the duty to inform, does not apply to the claim in Articles 15(3)(1), 12(5)(1) GDPR. A direct application already fails due to the unambiguous wording.
The prerequisites for an analogous application, namely the existence of an unplanned regulatory gap in a comparable interest situation, are not met.
The fact that Article 15 GDPR immediately follows the provision of Article 14 GDPR already speaks against the gap being unplanned. In this way, the legislator made it clear that in certain cases it saw the risk of a disproportionate effort and the resulting burden for the controller.
There is also not a comparable interest situation, as Article 14 GDPR concerns cases in which so many persons would have to be informed that this would mean a disproportionate effort. Unlike Article 15 GDPR, it is not the provision of information as such that is costly. Rather, the disproportionate effort results from the large number of persons to be informed, which is difficult to manage.
No Restrictive Regulation under Article 23 GDPR
The court then goes on to discuss restrictions under simple law from § 12(1) and (2) DSG NRW, which in the court's view do not constitute an offence. The court also reiterates that § 23(2) JAG NRW does not have a restrictive character (see above).
Claim Was Not Already Satisfied
The LJPA argued that the claim was already satisfied by the plaintiff's assertion of his right of inspection under § 23(2) JAG NRW with the accompanying option to take photos of examinations and examiners' reports or to have a copy made for a fee, and that he already had a "first" (free of charge) copy. Therefore, according to Article 15(3)(2) GDPR, an appropriate fee could be charged. The court disagrees with this. Since the two information claims pursue different objectives and the right of access is not equivalent to the right to copy data, it cannot be fulfilled. Nor could this result from an analogous application of Article 14(5)(a) GDPR, which provides for an exclusion if the data subject already has the information. As already examined, an analogous application cannot be considered (see above).
Controller's Right to Choose the Form of the Copy (in the Absence of an Electronic Request)
Finally, the court states that in the specific case, the controller has the right to choose whether to provide the data subject with the free copy in paper form or whether to provide him with the data in a standard electronic format. If, as in the present case, no electronic request has been made, which would regularly oblige the controller to provide the data electronically pursuant to Article 15(3)(3) GDPR, the controller generally has discretion under Article 12(1)(2) GDPR as to the form in which they provide the information.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
