OVG Münster - 16 A 1582/21
From GDPRhub
| OVG Münster - 16 A 1582/21 | |
|---|---|
 | |
| Court: | OVG Münster (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 12(5) GDPR Article 15(3) GDPR § 5(8)(1) DSG NRW § 23(2) JAG NRW |
| Decided: | 08.06.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 16 A 1582/21 |
| European Case Law Identifier: | ECLI:DE:OVGNRW:2021:0608.16A1582.20.00 |
| Appeal from: | VG Gelsenkirchen 20 K 6392/18 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | NRWE Rechtsprechungsdatenbank (in German) |
| Initial Contributor: | n/a |
The Higher Administrative Court of Münster found that an examinee had the right to be provided with a free copy of his state exams, including the examiners’ reports. The Court rejected the view that data subjects are only entitled to a copy of the information under Article 15(1) GDPR; rather, they are entitled to a copy of all existing data.
English Summary
Facts
The plaintiff took his second state law examination in the state of North Rhine-Westphalia, which consists of a (hand-)written part and a later oral part. He successfully completed the exam and did not challenge the assessment of his examination performance. After the examination was completed, i.e. after the oral examination, he requested the defendant, the State Judicial Examination Office (Landesjustizprüfungsamt, “LJPA”) send him the copies of his exams including the examiners’ opinions in electronic form or by post.
The LJPA stated that it would only agree to this for a fee of €69.70 to be paid in advance.
The claimant then renewed his claim and explicitly invoked Articles 15(3)(1) and 12(5) GDPR.
The defendant again rejected this. In particular, he pointed out that the material scope of application of the GDPR did not apply.
The plaintiff then filed an action. The court of first instance ruled in accordance with the application.
The defendant appealed against this, which is the subject of this summary.
Holding
The court dismissed the defendant's appeal. The court found that the defendant was obliged to provide the plaintiff with a copy of his exams prepared in the context of the second state law examination together with the examiners' reports in paper form or commonly used electronic form free of charge.
The court first ruled that the claim to the provision of a free copy of his examination papers prepared in the second state law examination together with the examiners’ reports follows from Articles 15(3)(1), 12(5)(1) GDPR in conjunction with § 5(8)(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW).
Applicability of Articles 15(3)(1), 12(5)(1) GDPR
The court first finds that Articles 15(3)(1), 12(5)(1) GDPR apply. However, it leaves open whether the material scope of application of the GDPR is opened or not opened due to Article 2(2)(a) GDPR.
In any case, the applicability follows from § 5(8)(1) DSG NRW. According to this provision, the provisions of the GDPR shall apply mutatis mutandis to processing operations that do not fall within the scope of Union law, unless this Part or other specific legal provisions contain deviating regulations.
In the court's view, these applicability requirements were met: (1) personal data were processed (2) partially automatically and (3) there were no deviating regulations.
Exams and Examiners' Reports as Personal Data
The first condition, i.e. the qualification of the exams and the examiners' reports as personal data within the meaning of Article 4(1) GDPR, was accepted, taking into account the broad case law of the CJEU. This was not precluded by the fact that the individual examiner cannot verify the identity of the individual examinee. There is only a pseudonymised identification number on the exams. By means of this, however, the LJPA can undoubtedly identify the examinee again with the help of separately stored information.
Processing of Personal Data Partly by Automated Means, Article 2(1) GDPR
The court swiftly found that processing within the meaning of Article 4(2) GDPR is in any case to be seen in the fact that the supervisory work is kept (storage) and ordered (as a sub-case of organisation) at the LJPA. The court emphasises that a completely non-automated action is also sufficient for the concept of processing. Next, the court found that there was partially automated processing. The court stated that data processing is partially automated within the meaning of Article 2(1) GDPR if it is at least partially supported by information technology and is not completely manual, i.e. if even only one function of the entire processing operation is supported by information technology. This is the case, for example, if a file system can be accessed through an automated index. These requirements were met. Even if the exams, including the examiners’ reports, are manually assigned in paper form to the respective file of the examinee, it is still possible to find and assign them via electronic data processing by means of the respective code number.
No Deviating Regulations
The court then finds that there are no deviating regulations within the meaning of § 5(8)(1) DSG NRW. This does not apply, in particular, to § 23(2) the Legal Education Act of North Rhine Westphalia (JAG NRW), which stipulates that an examinee must be allowed access to the examination papers, including the examiners' reports, on the premises of the LJPA within one month of notification of the examination decision.
This is initially attributed to the wording of the provision, which does not relate to the transmission of a free copy and in this respect does not constitute a deviating regulation.
The meaning and purpose of the provision can also not justify a priority of application over Articles 15(3)(1), 12(5)(1) GDPR. § 23(2) JAG NRW does contain a right to information, but this does not pursue any data protection (regulatory) objectives. Rather, it aims to ensure the transparency of the examination procedure and the effectiveness of legal protection (avoidance of a possible objection or legal action). In contrast, the right under Article 15 GDPR consists of giving the data subject the opportunity to be or become aware of the processing of his or her personal data and to be able to review the lawfulness of the data processing (cf. Recitals 7 and 63 GDPR). In this respect, it is a matter of transparency and lawfulness control of data processing - in contrast to § 23 (2) JAG NRW. The fact that the provision of information pursuant to § 23(2) JAG NRW leads to the provision of the same information is irrelevant against this regulatory background.
A different interpretation cannot follow from the deadline regulation in § 23(2) JAG NRW. The time limit for inspection is 1 month and is thus just as long as the time limit for the respective examination challenge. In contrast, the claim under Articles 15(3)(1), 12(5)(1) GDPR must be exercisable for the duration of the processing, especially the data retention in order to effectively realise the data subject's rights under data protection law.
Finally, the court points out that the provisions of the law on fees, according to which €69.70 must be paid in the present case, cannot constitute a deviating regulation. Any other interpretation would obviously contradict the EU law provisions of Article 23(1) and (2) GDPR.
Independent Claim to Provision of a Copy Free of Charge
The court first addresses the dispute as to whether Articles 15(3)(1), 12(5)(1) GDPR constitute an independent claim to the provision of a free copy or only regulate a special form of the information claim under Article 15(1) GDPR, so that the claim to a copy would only exist to the extent of the claim to information.
The court opts for the extensive interpretation and sees Articles 15(3)(1), 12(5)(1) GDPR as an independent claim. The broad concept of personal data underlying the GDPR (Article 4(1) GDPR), the wording and purpose of Article 15(3)(1) GDPR, as well as the history and systematics of the regulation speak against the restrictive interpretation.
According to the wording of Article 15(3)(1) GDPR, the data subject is entitled to "a copy of the personal data undergoing processing". The provision makes no reference to the information listed in paragraph 1, so there is no evidence of a limitation to such information. Since the wording refers to "personal data", it goes beyond the data and information listed in paragraph 1. Indeed, the “information” is not the personal data themselves, but other information relating to the processing of the data.
The use of the term "Gegenstand" (“subject matter”) in the German version also does not lead to a restrictive interpretation. The defendant interpreted this term restrictively as "subject" or "objective" and therefore thought that only an aggregated overview was owed. However, this was not convincing, as the term "Gegenstand" can also be understood as the content of a specific process, in this case data processing. This is confirmed with reference to the English version of the GDPR "a copy of the personal data undergoing processing".
The German word "eine" (which can mean either "a" or "one") does not support a restrictive reading either. This does not mean the numeral word "one" but only the indefinite article "a", which is again confirmed by the English version.
The court goes on to say that the meaning and purpose of the provision speak against a restrictive reading. In doing so, the court refers back to Article 8 CFR and Article 16(1) TFEU. Article 8(2)(2) CFR already enshrines the right of every person to obtain information and to have data rectified. The rights of data subjects under the GDPR are rooted in the European legislator's consideration that individuals must be able to decide for themselves on the disclosure and use of their personal data. The aim is for the data subject to be aware of the processing and, on this basis, to be able to review its lawfulness (cf. Recital 63 sentence 1 GDPR).
The court explained that this review also included the assessment of whether the data had been processed correctly in terms of content. Access to the data itself was necessary for this. This was also confirmed by Recital 63 sentence 4 GDPR, which postulates direct access by the data subject to his or her data. Access to the data itself also enables the assertion of further data subjects' rights ("necessary foundation of knowledge"). This is confirmed by reference to CJEU case law (C-553/07) on the predecessor provision in Directive 95/46/EC, in which the court emphasised the instrumental character of the right of access for the data subject's request that the controller correct, erase or block his or her data.
The interpretation is also not precluded by the claim under Article 20 GDPR, as this pursues a different objective, namely the provision of a format (and not a copy) that enables immediate further processing.
Finally, the court also addresses the history of the regulation, which does not speak in favour of a restrictive reading. The only point of reference for such a reading would be that Article 15 of the European Parliament legislative resolution of 12 March 2014 on the GDPR-proposal was initially titled "Right to access and to obtain data for the data subject" and after the conclusion of the legislative process was only titled "Right of access of the data subject". At the time of the legislative resolution, however, Article 15 only regulated the right to data portability (and not the provision of a copy). In this respect, no significance can be attached to this argument, as this right was finally regulated in Article 20 GDPR, where it is also only titled "Right to data portability".
A transposition of the CJEU case law in its judgment of 17 July 2014 - C-141/12, on Article 12(a) Directive 95/46/EC does not lead to a different result. In this decision, the CJEU had ruled that it was sufficient for the applicant to receive a complete overview of all personal data concerning him that were the subject of the processing in an intelligible form. However, this previous ruling did not contain a right to receive a copy of the data within the meaning of Article 15(3) GDPR and did not make any statement about such a right.
Insofar as the defendant further states that a transfer of the requested data would be unstructured and non-transparent and thus contradict the principle of Article 12(1)(2) GDPR ("intelligible form"). While the court is already unable to discern whether this assertion is correct, it points out that the cited provision serves to protect data subjects and that no restrictions on data subjects' rights can be derived from it.
An expansion of the scope of the claim is also not precluded. The legislator has recognised that claims for information may involve the processing of large amounts of data. This is responded to, for example, by the possibility of requesting a specification (Recital 63, sentence 7 GDPR) and by the possibility of extending the information deadline in Article 12(3)(2) GDPR.
Ultimately, the principle of data minimisation from Article 5(1)(c) GDPR does not stand in the way, as no new data is processed by creating the copies, but only existing data is duplicated. However, the copy is made available to the data subject - who is to be protected - at their request, without it having to remain with the controller.
No Exclusion by Other Provisions
The court then states that there is no discernible exclusion by other legal provisions.
No Conflicting Rights of the Examiners
First, an exclusion under Article 15(4) GDPR is rejected. In particular, no rights of the examiners would be opposed (trade secrets or intellectual property, cf. Recital 63, sentence 5 GDPR). This is justified by the fact that the corrections are made from the outset with the proviso that they are made available to the examinee upon request. Any other assessment would also contradict the guarantee of legal recourse (Article 19(4) of the German Constitution, GG), since the assessment must be accessible to review, which presupposes the prior knowledge of the examinee.
No Excessive Request
Also, Article 12(5)(2) GDPR does not preclude a claim, particularly in the absence of an excessive request. The excessiveness does not follow from the fact that the application comprises 348 pages to be copied. An application does not constitute excessive merely because of a high processing effort. Rather, what is required is the existence of abusive behaviour on the part of the claimant, which can be based, for example, on the harassing assertion of a data subject's right with the aim of damaging the controller.
The court already found that the unclipping and copying of the examinations together with the expert opinions did not constitute a disproportionate processing effort. In particular, it had to be clearly recorded which documents were involved and there was no need for the LJPA to first check whether the rights of third parties could be affected, as this was (obviously) not the case.
The LJPA's argument that there is a fear of a large number of requests and an associated increase in staff costs, a threatening cost burden and a jeopardisation of the examination procedure (2,500 examinees in this examination year; 12,500 in the past five examination years) is also irrelevant. This argument already lacks the necessary reference to an individual case in order to establish the abusive behaviour of the plaintiff.
The court leaves open whether the exceptional circumstances of Article 12(5)(2) GDPR also include cases in which the data subject pursues solely or predominantly non-privacy-related purposes in exercising the claim under Article 15(3)(1) GDPR. There are already no indications for the pursuit of purposes unrelated to data protection. This could only be due to the fact that the data protection claim allows a view into the examination procedure. In this case, however, this was only due to the fact that these claims existed side by side. In the present case, however, it was no longer possible to challenge the examinations under examination law.
No Analogous Application of Article 14(5)(b) variant 2 GDPR.
The court then held that the exception in Article 14(5)(b) variant 2 GDPR, according to which a disproportionate effort can lead to the inapplicability of Articles 14(1) to (4) GDPR and thus to the omission of the duty to inform, does not apply to the claim in Articles 15(3)(1), 12(5)(1) GDPR. A direct application already fails due to the unambiguous wording.
The prerequisites for an analogous application, namely the existence of an unplanned regulatory gap in a comparable interest situation, are not met.
The fact that Article 15 GDPR immediately follows the provision of Article 14 GDPR already speaks against the gap being unplanned. In this way, the legislator made it clear that in certain cases it saw the risk of a disproportionate effort and the resulting burden for the controller.
There is also not a comparable interest situation, as Article 14 GDPR concerns cases in which so many persons would have to be informed that this would mean a disproportionate effort. Unlike Article 15 GDPR, it is not the provision of information as such that is costly. Rather, the disproportionate effort results from the large number of persons to be informed, which is difficult to manage.
No Restrictive Regulation under Article 23 GDPR
The court then goes on to discuss restrictions under simple law from § 12(1) and (2) DSG NRW, which in the court's view do not constitute an offence. The court also reiterates that § 23(2) JAG NRW does not have a restrictive character (see above).
Claim Was Not Already Satisfied
The LJPA argued that the claim was already satisfied by the plaintiff's assertion of his right of inspection under § 23(2) JAG NRW with the accompanying option to take photos of examinations and examiners' reports or to have a copy made for a fee, and that he already had a "first" (free of charge) copy. Therefore, according to Article 15(3)(2) GDPR, an appropriate fee could be charged. The court disagrees with this. Since the two information claims pursue different objectives and the right of access is not equivalent to the right to copy data, it cannot be fulfilled. Nor could this result from an analogous application of Article 14(5)(a) GDPR, which provides for an exclusion if the data subject already has the information. As already examined, an analogous application cannot be considered (see above).
Controller's Right to Choose the Form of the Copy (in the Absence of an Electronic Request)
Finally, the court states that in the specific case, the controller has the right to choose whether to provide the data subject with the free copy in paper form or whether to provide him with the data in a standard electronic format. If, as in the present case, no electronic request has been made, which would regularly oblige the controller to provide the data electronically pursuant to Article 15(3)(3) GDPR, the controller generally has discretion under Article 12(1)(2) GDPR as to the form in which they provide the information.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Date:
08.06.2021
Court:
Higher Administrative Court NRW
Adjudicating body:
16th Senate
Decision type:
Judgment
Reference number:
16 A 1582/20
ECLI:
ECLI:DE:OVGNRW:2021:0608.16A1582.20.00
Previous instance:
Gelsenkirchen Administrative Court, 20 K 6392/18
Tenor:
The defendant's appeal against the judgment of the Administrative Court of Gelsenkirchen of 27 April 2020 is dismissed with the proviso that the defendant is obliged to provide the plaintiff free of charge with a copy of his examination papers prepared in the context of the second state law examination, including the examiner's report, in paper form or in a common electronic format, while annulling his decision of 6 November 2018.
The defendant shall bear the costs of the appeal proceedings.
The judgment is provisionally enforceable on account of the costs. The defendant may avert enforcement by providing security in the amount of 110% of the amount enforceable on the basis of the judgment, unless the plaintiff provides security in the amount of 110% of the respective amount to be enforced before enforcement.
The appeal is admitted.
1
Facts
2
The plaintiff seeks the free provision of an analogue or digital copy of his examination papers prepared within the framework of the second state law examination, together with the examiner's report.
3
The plaintiff took the second state law examination in the Land North Rhine-Westphalia under the reference number 4815/18 and successfully passed the oral examination on 26 September 2018. He did not challenge the assessment of his examination performance. In a letter dated 11 October 2018, he applied to the Landesjustizprüfungsamt Nordrhein-Westfalen (State Judicial Examination Office of North Rhine-Westphalia) to inspect the examination papers he had prepared and at the same time requested that the relevant copies be sent to him in electronic form or by post.
4
In a letter dated 19 October 2018, the Landesjustizpruefungsamt (State Judicial Examination Office) agreed to send the requested copies (348 pages in total) to the plaintiff for a fee of 69.70 euros to be paid in advance.
5
Thereupon, in a letter dated 25 October 2018, the plaintiff requested a copy of the data, citing Article 15(3), first sentence, and Article 12(5) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data. The applicant requested by letter of 25 October 2018, invoking Article 15(3), first sentence, and Article 12(5) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR) and the case-law of the Court of Justice of the European Union (CJEU), to be provided, free of charge, with copies or in a "standard electronic format" of the supervisory papers and the examiners' notes prepared by him.
6
By decision of 6 November 2018, served on the applicant on 15 November 2018, the Landesjustizizprüfungsamt rejected this request. The applicant was not entitled to such a claim. The scope of application of the General Data Protection Regulation had not been opened. The personal data contained in the written examinations were neither fully nor partially processed automatically, nor were they stored in a file system or should be stored in such a way.
7
The plaintiff brought an action on 17 December 2018. In support of his claim, he expanded on the arguments he had put forward in his letter of 25 October 2018 and further stated: The claim to the provision of the information he sought free of charge follows from Article 15 para. 3 sentence 1 in conjunction with Article 15 para. 3 sentence 2 in conjunction with Article 15 para. 3 sentence 2 in conjunction with Article 15 para. 3 sentence 2. V. Article 12(5), first sentence, of the GDPR. The material scope of application of the General Data Protection Regulation pursuant to Article 2(1) of the Regulation had been opened. Namely, according to the current practice of the State Judicial Examination Office, the written examination papers of the second state law examination are stored in a "file system" within the meaning of the aforementioned provision. According to the third sentence of recital 15 to the GDPR, only files or collections of files and their cover pages that are not organised according to certain criteria would not fall within the scope of the GDPR. The term file system is defined by Article 4(6) of the GDPR as any structured collection of personal data that is accessible according to certain criteria. File systems are collections of personal data that are structured in the same way and accessible according to certain characteristics. Sorting by persons was sufficient for this purpose. The substantive applicability of the GDPR was also not excluded by the area exception of Article 2(2)(a) GDPR (processing of personal data in the context of an activity which does not fall within the scope of Union law).
8
The examination papers, as well as the examiner's notes, are personal data. The examination papers were assigned to his person by means of the reference number. Furthermore, the examination papers marked by him were an expression of his identity. In its judgment of 20 December 2017 - C-434/16 -, Nowak, the Court of Justice of the European Union had analysed in detail the extent to which the answers given by a candidate in a written examination of a professional examination and the examiner's comments on those answers constituted personal data and were thus subject, inter alia, to the obligation to provide information under data protection law.
9
in conjunction with Article 12(5), first sentence, of the GDPR were fulfilled in the present case. According to the first sentence of Article 15(3) of the GDPR, if the scope of application of the GDPR is open and personal data are available, this claim is only dependent on the request or demand for information of the data subject. With his two letters to the defendant, he - the plaintiff - had requested information about his examination papers. Apart from that, the claim was not subject to any preconditions. The information had to be provided free of charge. Only for additional copies could an appropriate fee be demanded under Article 15(3), second sentence, of the GDPR. Pursuant to the third sentence of Article 15(3) of the GDPR, the personal data could also be provided by the controller in a commonly used electronic format; the plaintiff had expressly permitted this in his letter of 11 October 2018 by sending his email address. Third party rights did not prevent the claim pursuant to Article 15(4) of the GDPR. There was also no restriction of his right to information by national regulations in accordance with Article 23 of the GDPR. In particular, there is no restriction pursuant to Section 12 of the Data Protection Act of North Rhine-Westphalia (DSG NRW).
10
The plaintiff has requested - in writing,
11
1. the defendant's decision of 6 November 2018, ref. no. LJPA-572/18, be annulled.
12
(2) The defendant is ordered to provide the applicant, free of charge, with a copy of the examination papers prepared by the applicant under reference number 4815/18 in the context of the second state law examination in North Rhine-Westphalia, together with the examiner's report, in paper form or in a standard electronic format.
13
The defendant has applied - in writing,
14
dismiss the action.
15
The defendant argued that the material applicability of the GDPR with regard to the supervisory work carried out was already excluded by the exception contained in Article 2(2)(a) of the GDPR. Irrespective of this, the material scope of application of the General Data Protection Regulation was also not opened according to Article 2(1) of the GDPR. The purely manual, analogue organisation and storage of the written examination papers, which could only be found via the candidate's identification number, was not a non-automated processing of personal data stored in a "file system". This required an allocation according to several specific "criteria". The sole allocation of a code number as the only criterion to be able to allocate the analogously submitted examination papers to the respective examinee was not sufficient in this respect. Furthermore, it also follows from the overall context of the General Data Protection Regulation, namely the purpose of protecting the data subjects of data processing, that certain material aspects must be required for the organisation and structuring of non-automatically processed data. These would not be achieved by the organisation and storage of examination papers, which could only be assigned to the examinee by means of an identification number. If interpreted too broadly, almost all documents merely kept would be covered by the General Data Protection Regulation, since a singular criterion of any kind could always be found for organising collections of files. This, however, would counteract the restriction of the scope of application of the GDPR intended by Article 2(1) of the GDPR.
16
The provisions of the General Data Protection Regulation could also not be applied to the facts in dispute via Section 5(8) sentence 1 of the NRW Data Protection Act. With regard to the plaintiff's request to inspect the supervisory papers he had prepared, section 23(2) of the North Rhine-Westphalia Lawyers' Training Act (Juristenausbildungsgesetz Nordrhein-Westfalen - JAG NRW), as a special legal provision, contained a deviating regulation. On the basis of this, a corresponding application of the General Data Protection Regulation via § 5.8 sentence 1 DSG NRW was also excluded. According to § 23 (2) JAG NRW, the respective examinee was only to be allowed to inspect his or her examination papers, including the examiners' reports, on request at the premises of the State Judicial Examination Office, but not by providing copies free of charge. Within the scope of the right to inspect the examination papers prepared, which is guaranteed by special law under section 23 (2) JAG NRW, the production of copies of the same by the State Judicial Examination Office is only provided for against reimbursement of the expenses incurred.
17
If the General Data Protection Regulation - contrary to what has been said above - is nevertheless considered to be directly or correspondingly applicable, the plaintiff is nevertheless not entitled to a copy free of charge. This is because the claim asserted is in any case covered by the special statutory provision of section 23(2) of the JAG NRW i. In conjunction with the relevant provisions of the law on fees. The interests specifically mentioned in Article 23(1) of the GDPR, which could justify a restriction of the rights and obligations under Articles 12 to 22 of the GDPR, inter alia, by legal provisions of the Member States by way of legislative measures, are merely standard examples. Therefore, other interests - not expressly listed in Article 23(1)(e) of the GDPR - could also justify a restriction. The basic idea of the provision was to be able to restrict data subjects' rights under the General Data Protection Regulation in certain cases by means of a new legal provision or to maintain existing restrictions. The European Court of Justice had already clarified that an examinee's right to information under data protection law with regard to examination papers prepared by him or her could be restricted on the basis of Article 23(1)(e) of the GDPR by legal provisions of the Member States for the purpose of protecting "other important objectives" of the general public interest of the Union or of a Member State. For audit institutions, it is essential that access to audit files is structured. In view of the high number of examinations, it was also necessary that the right of access be limited in time by a deadline of one month after the announcement of the examination decision. Having to provide all candidates with free copies of their examination papers together with examiners' reports would not be feasible with the staffing possibilities of the State Judicial Examinations Office. In addition, it must be considered that the examinations, which are written with a wide variety of writing instruments, often with fountain pens, cannot be reliably copied or scanned purely by machine. According to the experience of the State Judicial Examination Office, copies of examinations are often hardly readable without manual correction of the copy or scan settings. In addition, the examinations had to be unstapled and later stapled again. Therefore, if such a claim were to be affirmed, it would have to be reckoned with the fact that each year approx. 552,000 pages (approx. 18,000 examinations of approx. 2,300 candidates with an average length of approx. 30 pages) would first have to be electronically recorded (scanned), stored, printed out and sent. This would not only jeopardise the functioning of the State Judicial Examinations Office, but at the same time it would lead the purpose of the General Data Protection Regulation "ad absurdum". Instead of minimising data, a digitally stored mass of personal data would be produced from a currently non-automatic analogue storage in a paper file by scanning the examination papers. In all of this, the restriction of the examinees' right to information to inspection at the State Judicial Examination Office was also proportionate. In particular, the candidates' possibilities of legal protection were not curtailed. They were free, without great effort, to take photographs of their examination papers together with the examiners' reports or to have copies made by the staff of the State Judicial Examinations Office against reimbursement of expenses.
18
The statutory restriction of the right to information under section 23(2) JAG NRW also complies with Article 23(2) DSGVO. § Section 23(2) JAG NRW had been inserted in its current version into the North Rhine-Westphalia Lawyers' Training Act in 2003, i.e. long before the General Data Protection Regulation entered into force. It had to be taken into account that Article 23(2) of the GDPR did not make any statement as to how detailed the restrictive legislative measure within the meaning of Article 23(1) of the GDPR had to be. In particular, the legislator of the General Data Protection Regulation did not want to interfere with the status quo of existing national laws. Against this background, it was not mandatory that the formal requirements of Article 23(2) GDPR had to be observed in their entirety for every restrictive national legislative measure. This could be deduced from the word "where appropriate" in the introductory sentence of Article 23(2) of the GDPR. This must apply in particular to restrictive provisions which, like Article 23(2) JAG NRW, already existed when the General Data Protection Regulation entered into force. § Section 23 (2) JAG NRW regulated the possibility for the examinee to inspect his or her examination papers. The standard made it clear that the data were processed for the purpose of conducting the examination procedure. This was particularly evident from the fact that the inspection also included the examiners' reports. Without this assessment, the purpose of the processing, the conduct of the examination procedure with the performance assessment as an elementary component, could not take place. With the examination papers including the expert opinions, the categories of personal data were also basically designated in the standard. The scope of the restriction was made clear by the fact that the standard specified exactly which data could be inspected, where the inspection had to take place and what time limit applied to the submission of the request for inspection.
19
The Administrative Court granted the application in its judgement of 27 April 2020. In its reasoning, it essentially stated: The action was admissible, in particular as an action for annulment in combination with a general action for performance. The action was also well-founded. The plaintiff was entitled to the asserted claim to be provided with a free copy of the examination papers he had written in the second state law examination, including the examiner's report, in paper form or in a common electronic format. It was left open whether the substantive scope of application of the General Data Protection Regulation was opened - which was predominantly the case. In any event, the claim arose from § 5.8 sentence 1 of the NRW Data Protection Act in conjunction with Article 15.1 of the Data Protection Act. In conjunction with Article 15(3), first sentence, and Article 12(5), first sentence, of the GDPR. According to the first sentence of Section 5(8) of the North Rhine-Westphalia Data Protection Act, the provisions of the General Data Protection Regulation and the provisions of Part 2 of the North Rhine-Westphalia Data Protection Act apply mutatis mutandis to processing that does not fall within the scope of Union law, unless this Part or other specific legal provisions contain deviating provisions. The requirements of Article 2(1), Article 12 and Article 15(3) of the GDPR, which are in any case to be applied mutatis mutandis, were fulfilled. The rights of data subjects under the General Data Protection Regulation were applicable pursuant to Article 2(1) of the Regulation, as the examinations, including the corrections, were "non-automatically processed", "personal" and stored in a "file system" data of the plaintiff. The European Court of Justice had stated in the Nowak case - still with a view to Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46/EC) - that a candidate's answers in a written examination and the examiner's comments on those answers constituted personal data of the examinee and were thus subject, inter alia, to the duty to provide information. This definition essentially corresponds to the definition in Art. 4 No. 1 of the GDPR, which now replaces Art. 2(a) of Directive 95/46/EC.
20
According to Article 4(2) of the GDPR, processing means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing or storage. Pursuant to section 64 sentence 1 JAG NRW, the written examinations of the state law examination, including the examiners' reports, were to be kept for five years, the other examination documents for 50 years. For this purpose, the examinations were archived in the State Judicial Examinations Office, sorted by year and index number. This storage of personal data in paper files fell under the concept of processing as a subcategory of organisation, arrangement and also storage in a non-digital form.
21
This non-automated storage of personal data also takes place in a file system within the meaning of Art. 4 No. 21. within the meaning of Art. 4 No. 6 of the GDPR. According to this provision, such a system is any structured collection of personal data accessible according to certain criteria, regardless of whether this collection is maintained centrally, decentrally or according to functional or geographical criteria. Even if one were to assume that, in the case of manual processing, the collection or the data contained in it had to be accessible according to certain criteria, i.e. at least two criteria, here two criteria, namely the year and the serial number in the respective year, were decisive for the storage system of the examinations. The fact that these two criteria were combined into a code number did not change the fact that both characteristics were decisive for sorting and retrieving the examinations of each individual examinee.
22
The plaintiff, as the author of the examinations, was the "person concerned" and thus the claimant. The State Judicial Examination Office, as the "person responsible" within the meaning of Article 4 no. 7 of the GDPR, was obliged to make a claim.
23
In terms of content, the claim encompassed the service sought by the plaintiff, namely the production of photocopies or, optionally, a data copy in a common electronic format. The right to a copy supplements the right to information under Article 15(1) of the GDPR, whereby both rights stand independently alongside each other. The right under the first sentence of Article 15(3) of the GDPR includes at least the right to a photocopy of those parts of a file kept in paper form that contain the applicant's personal data.
24
The copies requested by the applicant were also to be provided to him free of charge. The first copy must be provided free of charge. On the one hand, this follows directly from Article 15(3), first sentence, of the GDPR, according to which a fee can (only) be demanded for all further copies. On the other hand, the fact that it is free of charge follows from Article 12(5), first sentence, GDPR, according to which information and all notifications and measures are provided free of charge, inter alia, pursuant to Article 15 GDPR.
25
The claim is also not subject to the exclusions of Article 15(4) of the GDPR or the second sentence of Article 12(5) of the GDPR or is not limited by EU or German law within the meaning of Article 23 of the GDPR. Above all, it could not be inferred from § 23 (2) JAG NRW, which was referred to by the defendant, that the right of an examinee with regard to the examinations prepared by him/her, including their correction, was limited to a mere inspection on site and that the right to receive a copy was thus excluded at the same time. Neither the wording of § 23 (2) JAG NRW stated that "only" an inspection was permissible, nor did it state elsewhere that the law prohibited the handing over of copies. The different regulatory content of the two provisions on the right to inspection also argued that the right to inspection under Section 23(2) JAG NRW stood alongside the right under the first sentence of Article 15(3) of the GDPR. The right to inspection concerned the original documents, whereas the right to a copy only provided access to a reproduction. Moreover, in practice, the Land Judicial Examination Office had previously made copies at the request of an examinee and made them available by post. The provisions of Land law on fees referred to by the defendant also did not restrict the "gratuitousness" provided for in Article 15(3), first sentence, and Article 12(5), first sentence, of the GDPR. These did not specifically refer to the making of copies of exam examinations. If these provisions were to suffice as a limitation of the right to a free copy under Article 15(3), first sentence, and Article 12(5), first sentence, GDPR, the right would always be excluded as a consequence. For this reason alone, these general provisions, when interpreted in conformity with EU law, could not have a restrictive effect within the meaning of Article 23 GDPR with regard to gratuitousness. Irrespective of the fact that both Section 23(2) JAG NRW and the provisions of the law on fees with regard to Article 15(3), first sentence, of the GDPR and Article 12(5), first sentence, of the GDPR were already not restrictive in approach, the requirements of Article 23(1) of the GDPR for restrictive provisions were also not met. In particular, a restriction to on-site inspection and the possibility of obtaining only copies for which a fee was charged was not necessary to "protect other important objectives of general public interest of the Union or of a Member State" within the meaning of Article 23(1)(e) of the GDPR. The defendant had not demonstrated an "important objective of general public interest of the Union or of a Member State" by referring to the impending cost burden and the functioning of the State Judicial Review Office.
26
In support of his appeal, which was admitted by the Administrative Court and was filed in due time, the defendant repeats and expands on his submissions at first instance and states in this regard: The claim asserted by the plaintiff is not given. It does not follow from § 5.8 sentence 1 DSG NRW in conjunction with Article 15.1 DSG NRW. In conjunction with Article 15(3), first sentence, and Article 12(5), first sentence, DSGVO. In this respect, the scope of application of the General Data Protection Regulation pursuant to Article 2(1) of the Regulation was already not open, as there was no storage in a file system with regard to the storage of the corrected written examination papers and the examiners' reports. The definition in Article 4 no. 6 of the GDPR and recital 15, third sentence, indicate that a collection of personal data accessible according to several criteria is required for this purpose. Accessibility on the basis of only one criterion, such as in this case the allocation of the written examination papers submitted in paper form to an examinee on the basis of an identification number, was not sufficient. The fact that the identification number used in the Land Judicial Examination Office consisted of a serial number and a year did not contradict this. These were not independent elements which in themselves made it possible to allocate the examination papers to an examinee.
27
Even if one assumes that the scope of application of the General Data Protection Regulation is open, the plaintiff's claim to the free copies he seeks is precluded by the fact that the claim is based on Article 15(3), first sentence, in conjunction with Article 12(3), first sentence, in conjunction with Article 12(3), first sentence, in conjunction with Article 15(3), first sentence, in conjunction with Article 15(3), first sentence. In conjunction with Article 12(5), first sentence, of the GDPR, did not include this service. The first sentence of Article 15(3) of the GDPR merely regulated a special form of information under Article 15(1) of the GDPR and could not go further than the right to information under that provision. It follows that under the first sentence of Article 15(3) of the GDPR, only the data covered by Article 15(1) of the GDPR must be communicated as a copy of the right to information that exists under that provision. This follows from the meaning and purpose of the right to information under Article 15(1) of the GDPR. According to recital 63 to the GDPR, the purpose of the right of access is to provide the data subject with an overview of the scope and content of the personal data stored about him or her in order to enable him or her to verify the lawfulness of the processing and to exercise the other rights concerned, such as the right to erasure or restriction of processing. On this basis, it was not necessary to inform the person concerned of all the documents or files stored by the controller. Rather, the claim under Article 15(3), first sentence, of the GDPR is already fulfilled if the controller provides the data subject with a complete overview of the data concerning him or her in an understandable form. Based on this, the right to information pursuant to Article 15(3), first sentence, of the GDPR with regard to the examination papers prepared in the second state law examination and the examiners' reports merely granted a right to be informed in a condensed and comprehensible form about the name and the identification number of the examinee and about the fact that he or she had prepared and handed in eight examination papers in the second state law examination, about the date and place of the respective examination, the names of the examiners as well as the mark and the number of points with which the individual examination papers had been assessed. The first sentence of Article 15(3) of the GDPR does not confer a right to be provided with a comprehensive copy. This was confirmed by an interpretation of Article 15 (3) sentence 1 of the GDPR. It was already clear from its wording that the controller provided a copy of the personal data that were the subject of the processing. Thus, the wording referred to the "subject-matter", i.e. the essential information that a controller processed about the data subject. The term "object" was also understood in common parlance as a synonym for a subject or a goal. The term therefore described an abstract level of consideration. It followed from this that "objective data" could not mean all existing data, but only an aggregated overview of these data. Moreover, Article 15(3), first sentence, of the GDPR speaks of a single copy and not in the plural, for example, of "comprehensive copies". This made it clear that the data subject should receive his or her personal data in a single uniform document. Extensive data sets could not regularly be presented in a single copy in a transparent and easily understandable way.
28
The legislative history of the General Data Protection Regulation also speaks in favour of a restrictive interpretation of Article 15 (3) sentence 1 of the GDPR. In the original draft of the GDPR, a comprehensive right of access and disclosure had been inserted in Article 15 by resolution of the European Parliament of 12 March 2014. In the final version of the General Data Protection Regulation, however, there was no corresponding reference to a right of access. Accordingly, the title of Article 15 of the GDPR had been changed from "Right of access and disclosure" to "Right of access". The final version had been completed after the ruling of the European Court of Justice on the right of access under Article 12 of Directive 95/46/EC on 17 July 2014. When creating Article 15 of the GDPR, the European legislator was therefore well aware that the Court of Justice had not interpreted the right of access extensively and had not assumed a separate right to a copy. This shows that the European legislator deliberately decided not to apply the right to copies to all data sets containing personal data about the data subject.
29
From a systematic point of view, too, there is much to suggest that the right to copy only encompasses the catalogue information within the meaning of Article 15(1)(a) to (h) of the GDPR and that data subjects have no further claims. The wording of Article 15(3)(1) of the GDPR is comparatively restrictive; it only provides for a copy of "the personal data" and, unlike Article 28(3)(g) of the GDPR or Article 58(1)(e) of the GDPR, does not refer to "all" personal data. The fact that Article 15(1) and (3) of the GDPR do not form two independent claims, but rather a single claim, is also supported by the fact that the first sentence of Article 15(3) of the GDPR does not contain any requirements for a claim, but merely stipulates that "[t]he controller shall provide a copy".
30
Another systematic argument can be derived from Article 20(1) of the GDPR, according to which the data subject has the right to "receive personal data concerning him or her which he or she has provided to a controller in a structured, commonly used and machine-readable format". If the data subject already had a right to receive a copy of all personal data pursuant to Art 15(3), first sentence, GDPR, Art 20(1) GDPR would be empty and superfluous.
31
Finally, a teleological view of Article 15(3), first sentence, GDPR would not lead to a different result. The purpose of the right to copy is to enable the data subject to review the data processing concerning him or her. For this purpose, the data subject does not need access to all the personal data held by the controller. In addition, the transmission of such a quantity of data would be highly unstructured and non-transparent and would contradict the principle of communication in an intelligible form from Article 12 (1) sentence 1 GDPR. Furthermore, a broad understanding of Article 15 (3) sentence 1 of the GDPR would run the risk that the scope of the controller's obligation would get out of hand too easily, which could not be the intention of the European legislator in terms of an effective and practical handling of the General Data Protection Regulation. This is also supported by the provision in Article 15 (4) of the GDPR.
32
A restrictive interpretation of the first sentence of Article 15(3) of the GDPR is also necessary to prevent the claim for the surrender of copies from being asserted for purposes not related to data protection. With regard to the examination papers, this followed in particular from the fact that the plaintiff as well as the other examinees were prevented from asserting the claim under Article 15(3), first sentence, in conjunction with Article 12(3), first sentence, of the Regulation. In connection with Article 12(5), first sentence, of the GDPR, it was clearly not a matter of checking whether the corrected examination papers had been processed in accordance with data protection law. Rather, the appeal to the aforementioned provisions was based on the fact that the examinees - including the plaintiff - wanted to receive copies of their corrected examination papers free of charge for reasons of convenience, without having to go to the State Judicial Examinations Office in person, in order to be able to look at the corrections and assessment justifications of the examiners and, if necessary, to assess the prospects of success of lodging an appeal against the examination decisions. In addition, the examination papers and the associated examiners' reports did not have a sufficiently "biographical" personal reference, as they were completely anonymised due to the allocation of index numbers and did not allow any conclusion to be drawn about the person of the examinee. The claim for a copy of the data to be sent free of charge therefore also fails independently due to the requirement of a sufficient personal reference.
33
Moreover, a possible claim by the plaintiff pursuant to Article 12 (5) sentence 2 of the GDPR was excluded because his request was an excessive request within the meaning of this provision. This already followed from the fact that this request was for 348 pages to be made available free of charge. In addition, only purposes unrelated to data protection were being pursued. Accordingly, he, the defendant, was entitled to demand an appropriate fee for the production of the copies in question pursuant to Article 12(5) sentence 2(a) of the GDPR.
34
A claim was also not given due to an analogous application of Article 14(5)(a) and (b) variant 2 of the GDPR. According to these provisions, the application of Article 14(1) to (4) of the GDPR is excluded if the data subjects already have the information or if the provision of the information would require a disproportionate effort. The plaintiff already had the information in question because he, the defendant, had allowed him to inspect the originals of the examination papers. In addition, it would cause a disproportionate effort to have to provide the plaintiff with copies of his examination papers together with the examiners' reports. In the case of confirmation of the first instance judgment, a high number of requests for free copies could be expected. This would entail a considerable personnel and financial effort for the State Judicial Examination Office. Up to 15,000 applications for free copies of examinations could be expected, which could not be handled with the existing staff of the office. Instead, up to three additional posts would be required, which would result in an additional burden on the state budget.
35
Furthermore, a possible claim of the plaintiff was excluded under § 23.2 JAG NRW. These are special provisions within the meaning of § 5.8 sentence 1 DSG NRW, which contain a deviating regulation. § Compared to Article 15(3), first sentence, of the GDPR, Section 23(2) of the JAG NRW constitutes a conclusive provision with regard to the provision of information and disclosure in relation to corrected written examination papers and examiners' reports in the second state law examination. Due to this conclusive regulatory character, it could not be assumed, contrary to the administrative court's opinion, that § 23.2 JAG NRW and Article 15.3 sentence 1 GDPR were in competition with each other. The conclusive regulatory character of the said provision was already apparent from the time limit provision in § 23.2 sentence 3 JAG NRW, according to which the application for inspection had to be submitted to the State Judicial Examination Office within one month after notification of the examination decision. Conversely, it follows that a candidate's right to receive information about the exact content of the reasons for the assessment of his or her examination papers is generally excluded if a request for inspection is not made within the statutory period of one month. With § 23.2 sentence 3 JAG NRW, the legislator thus pursued the goal of granting the examinee a comprehensive legal right to information and disclosure with regard to the exact reasons for the assessment only until the examination decision had become final. In this respect, the idea of transparency also recedes as soon as the examination decision has become final. Furthermore, the aforementioned provision was recognisably intended to safeguard the functioning of the Land Judicial Examination Office by ensuring that the human and material resources of the examination authority were not permanently used excessively for activities that were no longer necessary for the granting of effective legal protection in view of the examination decision becoming final. Moreover, with the flood of requests for information already described, a proper handling of the examination proceedings could no longer be ensured.
36
Moreover, the fact that the legislature had regulated the information of the examinee on the exact content of the reasons for the assessment of his or her examination papers exclusively and explicitly in the form of a right of inspection to be exercised on the spot was evidence that a legal claim to other forms of obtaining knowledge by the examinees was to be excluded in principle. The aforementioned objectives of Section 23(2) JAG NRW would be completely thwarted and rendered meaningless if this provision were not regarded as another special legal provision with a different regulatory content within the meaning of Section 5(8) sentence 1 DSG NRW.
37
In view of the legislative intention described above, Section 23(2) JAG NRW must also be qualified as a legislative measure restricting rights within the meaning of Article 23 of the GDPR. This assumption was confirmed by the supreme court's fiscal jurisdiction. The Federal Supreme Finance Court had ruled that rights of access to files standardised by special law in procedural rules (§ 78 FGO) took precedence over data protection law and thus also over the right to information under Article 15(1) and (3) of the GDPR, and thus had a conclusive character. In addition, the Federal Supreme Finance Court had clarified that the right to inspect files regulated in § 78 FGO was a provision restricting rights within the meaning of Article 23(1)(f) of the GDPR. § Section 23(2) of the JAG NRW also met the requirements of Article 23(1) of the Regulation, namely letters (c) and (d). The aforementioned provisions from the NRW Lawyers' Training Act served public security. This is because the legal mandate of ensuring and maintaining a proper examination process would be concretely endangered if all examinees were entitled to receive complete copies of their examination papers and examiner's reports free of charge for an unlimited period of time. In addition, the requirements of Article 23(1)(e) of the Regulation were also met, because the right of access pursuant to § 23(2) of the JAG NRW served the protection of other important objectives of the general public interest in Germany by guaranteeing the functioning of the State Judicial Examination Office and the proper conduct of the examination procedure, while at the same time safeguarding the financial interest of the State of North Rhine-Westphalia. The statutory restriction of the right to information under Article 15.3 sentence 1 in conjunction with Article 12.3 sentence 1 was not justified. In conjunction with Article 12(5), first sentence, of the GDPR, Section 23(2) of the JAG NRW finally also complies with the formal requirements of Article 23(2) of the GDPR.
38
Moreover, any claim of the plaintiff had already been fulfilled by the fact that he had been given the opportunity to inspect his examination papers and the examiners' reports at the State Judicial Examination Office and to take photographs in the course of this.
39
The defendant also suggested a reference for a preliminary ruling to the Court of Justice of the European Union pursuant to Article 267 of the Treaty on the Functioning of the European Union (TFEU).
40
The Respondent requests,
41
to amend the judgment of the Administrative Court of Gelsenkirchen of 27 April 2020 - 20 K 6392/18 - and to dismiss the action.
42
The plaintiff applies for
43
dismiss the appeal.
44
The plaintiff essentially replies to the grounds of appeal, repeating in part his submissions at first instance, that the defendant had not already complied with the right under Article 15(3), first sentence, of the GDPR by providing the opportunity to inspect the originals of the examination papers, including the examiner's report, because the inspection was not equivalent to making them available. The act of copying was already lacking. An analogous application of Article 14(5)(a) and (b)(2) of the GDPR was not possible. The plaintiff did not have the information in question, nor was the claim or its fulfilment disproportionate. An unintended regulatory gap was also not apparent, as the legislator had already provided for explicit exceptions in Art. 12(5) sentence 2 and Art. 15(3) sentence 2 and (4) of the GDPR.
45
For further details of the facts and the dispute, reference is made to the content of the court file and the administrative file of the defendant.
46
Reasons for the decision
47
The admissible appeal of the defendant is unsuccessful - apart from the proviso that he is not ordered, but obliged, to send free of charge a copy of the supervisory papers prepared by the plaintiff under reference number 4815/18 in the context of the second state examination in law, together with the examiner's report. The action is admissible (see I.) and well-founded (see II.).
48
I. The admissible action for the provision of a free copy of the plaintiff's examination papers prepared in the second state examination, together with the examiner's report, is an action for an order pursuant to § 42.1 alternative 2 of the Administrative Court Code (VwG). 2 of the Administrative Court Rules (VwGO).
49
It is true that the plaintiff seeks to achieve an actual result through simple administrative action, namely the provision of a free copy on the basis of Article 15(3) sentence 1 in conjunction with Article 12(3) sentence 2. In conjunction with Article 12 (5) sentence 1 of the GDPR. However, this request is preceded by an administrative act of the defendant in the form of a decision on the asserted data protection right to information.
50
Cf. on the right to information under Article 15(1) of the GDPR BVerwG, judgment of 16 September 2020 - 6 C 10.19 -, juris, para. 12 with further references. N.; on the right to file inspection and transmission of an extract from a tax account, see. OVG Hamburg, Judgment of 8 February 2018 - 3 Bf 107/17 -, juris, marginal no. 22.
51
Just like the granting of information pursuant to Article 15(1) of the GDPR, the granting of a copy pursuant to the first sentence of Article 15(3) of the GDPR is preceded by an official (individual case) decision with external effect, which is to be made on the basis of a statutory review programme (cf. inter alia Article 15(4) and Article 12(5) of the GDPR) and in which the authority must observe special procedural precautions such as obligations to state reasons or to be heard, as well as review possible exclusion and restriction facts.
52
II. The action is well-founded. The plaintiff has a claim to the provision of a free copy of his examination papers prepared in the Second State Law Examination together with the examiners' report. The defendant's (refusal) decision of 6 November 2018 is unlawful and violates the plaintiff's rights (see § 113.5 sentence 1 VwGO).
53
The claim of the plaintiff is based on Art. 15 para. 3 sentence 1, Art. 12 para. 5 sentence 1 DSGVO in conjunction with Art. 5 para. 8 sentence 1 DSG NRW (see 1., 2.) and is not excluded by other legal provisions (see 3.) or limited within the meaning of Art. 23 DSGVO (see 4.). The claim is not extinguished by performance (see 5.). The defendant has a right of choice with regard to the fulfilment of the claim (see 6.).
54
The basis for the asserted claim is Article 15(3), first sentence, Article 12(5), first sentence, of the GDPR in conjunction with Section 5(8), first sentence, of the NRW Data Protection Act.
55
Pursuant to Art. 15(3), first sentence, DSGVO, the controller shall provide the data subject with a copy of the personal data that are the subject of the processing, free of charge pursuant to Art. 12(5), first sentence, DSGVO. As a result, it can remain open whether Art. 15(3) first sentence and Art. 12(5) first sentence GDPR are directly applicable here or whether the material scope of application of the GDPR is not opened pursuant to Art. 2(2)(a) GDPR. This is the case if the processing of personal data at issue takes place in the context of an activity that does not fall within the scope of application of Union law.
56
Cf. on the scope of application of Union law in relation to Article 51(1) CFR and Article 19 TFEU ECJ, judgments of 10 July 2014 - C-198/13 -, juris, para. 34 f., and of 19 November 2019 - C-609/17 and others, juris, para. 46 f.; see also BVerwG, judgment of 30 January 2020 - 10 C 18.19 -, para. 42.
57
In any case, Article 15(3), first sentence, and Article 12(5), first sentence, DSGVO are to be applied accordingly pursuant to Section 5(8), first sentence, DSG NRW.
58
Pursuant to its Section 1(1), the Data Protection Act of North Rhine-Westphalia makes the supplementary provisions necessary for the implementation of the General Data Protection Regulation. Pursuant to Section 5(8), first sentence, DSG NRW, which, according to the heading of Section 5, is part of the regulations on the scope of application of the Data Protection Act of North Rhine-Westphalia, the provisions of the General Data Protection Regulation and the provisions of Part 2 of this Act shall apply mutatis mutandis to processing operations which do not fall within the scope of application of Union law, unless this Part or other specific legal provisions contain deviating regulations.
59
The factual prerequisites of § 5.8 sentence 1 DSG NRW are met. The supervisory papers prepared by the plaintiff in the second state examination in law and the examiners' reports on them, to a copy of which the plaintiff is entitled free of charge, are personal data within the meaning of Article 4 no. 1 of the Regulation on the Protection of Personal Data in the Internal Market (DSGVO), which applies mutatis mutandis (see a)), and which are processed by the State Office for the Examinations of Laws (Landesjustizizprüfungsamt) in a partially automated manner within the meaning of Article 2(1) and Article 4 no. 2 of the Regulation on the Protection of Personal Data in the Internal Market (DSGVO) (see b)). There are no other legal provisions that contain a deviating regulation (see c)).
60
a) According to Art. 4 No. 1 GDPR, personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
61
The concept of personal data must be interpreted broadly. According to the case law of the European Court of Justice on Article 2(a) of Directive 95/46/EC - the predecessor provision to Article 4(1) of the GDPR, which is essentially identical in content - the term potentially includes all types of information of both an objective and subjective nature, e.g. in the form of opinions or assessments, if it is information "about" the person in question. The latter condition is met if the information is linked to a specific person by virtue of its content, purpose or effects.
62
See ECJ, Judgment of 20 December 2017.
63
- C-434/16 -, Nowak, juris, para. 33 et seq.
64
This is the case with regard to the examination papers prepared by the applicant in the second state law examination and the examiners' reports. The parties' correct and consistent assumption in this regard is in line with the aforementioned supreme court case-law of the European Court of Justice.
65
See also Schild, in: BeckOK, Datenschutzrecht, Wolff/Brink, 36th edition, 1 May 2021, Art. 4 marginal no. 21a.
66
The fact that the examiner cannot (directly) identify the examinee at the time of correction and evaluation does not prevent this. It is sufficient that the institution organising the examination is in possession of the necessary information, as in this case, which enables it to identify the candidate easily and without doubt by means of his or her identification number affixed to the examination paper and to allocate his or her answers to him or her.
67
See ECJ, judgment of 20 December 2017.
68
- C-434/16 -, Nowak, juris, para. 30 f.
69
In contrast to the processing of anonymous data, the data subject can also be identified again after pseudonymisation - as in the present case through the allocation of an identification number for the examinee by the State Judicial Examination Office (cf. Section 13(2) in conjunction with Section 53(2) JAG NRW) - by using separately stored information (cf. Article 4(5) of the GDPR and Recital 26, second sentence, to the GDPR).
70
Cf. Schwartmann/Mühlenbeck, in: Schwart-mann/Jaspers/Thüsing/Kugelmann, DS-GVO/ BDSG, 2018, Art. 4 para. 10 and 65.
71
b) These personal data are processed by the i. The State Office for the Judicial Review (Landesjustizpruefungsamt), which is the data controller within the meaning of Art. 4 No. 7 DSGVO, and partly by automated means within the meaning of Art. 2(1), Art. 4 No. 2 DSGVO.
72
According to Article 4(2) of the GDPR, processing includes any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
73
Data processing, according to this definition, is any operation that is somehow related to personal data. This covers not only typical data uses such as storage, transmission or modification of data, but all forms of handling personal data from collection to final storage. It is irrelevant whether the process is carried out with or without the aid of automated procedures (cf. recital 15, second sentence, to the GDPR).
74
Cf. Roßnagel, in: Simitis/Hornung/Spieker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 4 No. 1 Rn. 10 et seq.
75
Collecting or storing within the meaning of Article 4 No. 2 of the GDPR is understood to mean recording or storing personal data on a data carrier for the purpose of their further processing or use. The organisation of personal data is the result of collecting and arranging data, whereby the organisation is usually based on a systematic structuring of the collection and is intended to simplify or improve the possibility of finding and evaluating personal data. Arranging - as a subset of organising - is the activity that leads to an organised collection of data. Arranging is done in a structure according to which the personal data can be stored, retrieved and accessed. Storage is the technical process and state of keeping personal data for the purpose of their further processing or use.
76
Cf. Roßnagel, in: Simitis/Hornung/Spieker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 4 No. 2 Rn. 15 to 19; Ernst, in: Paal/Pauly, DS-GVO BDSG, 3rd ed. 2021, Art. 4 Rn. 24 to 26; Herbst, in: Kühling/Buchner, DS-GVO, BDSG, 3rd ed. 2020, Art. 4 Rn. 21 to 24.
77
Data processing is partially automated within the meaning of Article 2 (1) of the GDPR if it is at least partially supported by information technology and is not completely manual, i.e. if only one function of the entire processing operation is supported by information technology. This is the case, for example, if a file system can be accessed through an automated index.
78
Cf. Roßnagel, in: Simitis/Hornung/Spieker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 2 Rn. 14; Kühling/Raab, in: Kühling/Buchner, DS-GVO, BDSG, 3rd ed. 2020, Art. 2 Rn. 16.
79
Based on this, and taking into account the information provided in this regard by the representative of the State Judicial Examination Office at the oral hearing before the Senate, the plaintiff's personal data in dispute is partially processed automatically. According to this, the examinations and the examiners' reports are kept in paper form in the respective file of the examinee, sorted by year and code number. However, they can be found and assigned to the respective examinee, in this case the plaintiff, via electronic data processing by means of the respective identification number.
80
Therefore, the Senate can leave open the question disputed between the parties whether, in the event that the plaintiff's paper file cannot be found electronically, his personal data can be stored in a file system within the meaning of Article 2(2) of the Basic Law. within the meaning of Article 2(1) and Article 4(6) of the GDPR.
81
Cf. in this context on the identical provision in Art. 2(c) of Directive 95/46/EC - repealed by Section 94(1) of the GDPR - ECJ, Judgment of 10 July 2018 - C-25/17 -, Jehovah's Witnesses, para. 56.
82
c) There are no deviating provisions within the meaning of § 5.8 sentence 1 DSG NRW with regard to the claimant's right to receive a free copy of his personal data at issue. Neither the Data Protection Act of North Rhine-Westphalia nor other specific legal provisions contain deviating regulations in this respect.
83
§ Section 23 (2) JAG NRW, which also applies to the second state law examination pursuant to section 56 (1) JAG NRW, is not a special deviating legal provision within the meaning of section 5 (8) sentence 1 DSG NRW. This provision, according to which the candidate must be allowed to inspect his or her examination papers, including the examiners' reports, on the premises of the Judicial Examinations Office within one month after notification of the examination decision, does not constitute a sector-specific final regulation with regard to claims for information on personal data in legal training in North Rhine-Westphalia. In particular, it cannot be inferred from this provision that an examinee's right to information with regard to the examination papers he or she has prepared, together with the examiner's opinion, is to be limited to mere on-site inspection and that the right to obtain a copy free of charge is thus to be excluded.
84
The wording of section 23(2) JAG NRW does not support a contrary assumption, as it does not refer to the transmission of a free copy of data and does not otherwise indicate that inspection is to be the only permissible way of obtaining knowledge.
85
Nor does the meaning and purpose of the right of inspection under section 23(2) JAG NRW indicate that it takes precedence over the first sentence of Article 15(3) and the first sentence of Article 12(5) of the GDPR or excludes their application. § Section 23 (2) JAG NRW is in principle an information provision, just like Art. 15 (3) sentence 1 DSGVO. However, it does not pursue any (regulatory) objectives under data protection law. Rather, section 23(2) JAG NRW is intended to enable the examinee to inspect his or her examination papers, including the examiners' reports, on the premises of the State Judicial Examinations Office and, as can be seen from the legislative materials, serves to increase the transparency of the examination procedure and - in the run-up to or in order to avoid any appeal or legal action - the effectiveness of legal protection.
86
Cf. LT-Drs. 13/3197, p. 87.
87
This regulatory purpose, which was also the basis of section 15(6) JAG NRW old version - the predecessor provision of section 23(2) JAG NRW,
88
cf. Rehborn/Schulz/Tettinger, Die Juristenausbildung in Nordrhein-Westfalen, commentary, 7th ed. 1994, § 15 marginal no. 13,
89
thus differs substantially from the regulatory objective of the right under Art. 15 GDPR. This consists of giving the data subject the opportunity to be or become aware of the processing of his or her personal data and to be able to check the lawfulness of the data processing (cf. recitals 7 and 63 to the GDPR). In this respect, it is therefore - in contrast to Section 23 (2) JAG NRW - about the transparency and lawfulness control of the data processing.
90
Cf. Dix, in: Simitis/Hornung/Spieker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 15 Rn. 1; Schmidt-Wudy, in: BeckOK Datenschutzrecht, Wolff/Brink, 36th Edition, 1 May 2021, Art. 15 Rn. 2; Schwartmann/Klein, in: Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 2018, Art. 15 Rn. 1.
91
A different assessment with regard to the regulatory character of section 23(2) JAG NRW does not result from the time limit provision in its third sentence. According to this provision, the application for inspection must be submitted to the State Judicial Examination Office within one month of the notification of the examination decision. The aim of this provision - linked to the regulatory purpose of the right of inspection - is to grant the examinee a comprehensive legal right to information only until the examination decision has become final. On the other hand, it must be possible to exercise the right under Article 15(3), first sentence, and Article 12(5), first sentence, of the GDPR for the duration of the data retention in order to effectively realise the data subject's rights under data protection law.
92
The legislative history of Section 23(2) JAG NRW does not provide anything for the question of speciality at issue here, as the provision in its current form is based on the Juristenausbildungsgesetz NRW in the version of 11 March 2003 (GV. NRW. 2003, 135), while the GDPR has only been applicable since 25 May 2018. However, even the current draft bill of the Land government of 16 April 2021 on the Second Act Amending the North Rhine-Westphalia Lawyers' Training Act (LT-Drs. 17/13357) does not provide any indications that the right of inspection under section 23(2) JAG NRW has a conclusive character vis-à-vis the claim under Article 15(3) sentence 1 in conjunction with Article 12(2) JAG NRW. In conjunction with Article 12(5), first sentence, DSGVO, because it does not comment on the relationship between the two provisions.
93
The assumption of a conclusive provision in Article 23(2) JAG NRW is also not supported by the fact that, like Article 15(3), first sentence, GDPR, it results in the same information content being conveyed. This is because the provisions differ in their regulatory content. The right under section 23(2) JAG NRW refers to an on-site inspection of the original documents, whereas the right to a copy conveys access to a (free) reproduction. The fact that, according to the defendant's submission, the State Judicial Examination Office in principle also permits the production of photographs during the inspection or produces copies against payment does not lead to a different result, if only because there is no corresponding statutory provision in § 23.2 JAG NRW and because the copies are not free of charge.
94
On the basis of this, the provisions of the law on fees referred to by the defendant for the demanded fee of 69.70 euros in conjunction with § 23.2 JAG NRW are also not special legal provisions that supersede the claim to the transmission of a free copy. The contrary assumption would have the consequence that these general provisions of fee law would exclude the free transmission of the first copy provided for in Art. 15 (3) sentence 1, Art. 12 (5) sentence 1 GDPR in practically all administrative areas in which the Land law on fees is applicable. This would (obviously) not comply with the EU law requirements of Art. 23 (1) and (2) GDPR regarding national restrictions on the right to a free copy of data.
95
Pursuant to Article 15(3), first sentence, and Article 12(5), first sentence, of the GDPR in conjunction with Article 5(8), first sentence, of the NRW Data Protection Act, the plaintiff is entitled to be provided, free of charge, with the copy he seeks of all personal data that are the subject of the processing in the form of the storage of his examinations for the second state law examination, together with the examiner's report.
96
The Senate assumes that Article 15 (3) sentence 1 in conjunction with Article 12 (3) sentence 2 is applicable. In conjunction with Article 12(5), first sentence, of the GDPR, the data controller is obliged to provide the data subject with a copy of all existing personal data that are the subject of the processing free of charge (so-called extensive interpretation).
97
Likewise Bäcker, in: Kühling/Buchner, DS-GVO, BDSG, 3rd ed. 2020, Art. 15 Rn. 6 and 39a; Schmidt-Wudy, in: BeckOK Datenschutzrecht, Wolff/Brink, 36th edition, status 1 May 2021, Art. 15 Rn. 85; Lembke, Der datenschutzrecht-liche Auskunftsanspruch im Anstellungsverhältnis, NJW 2020, 1841 (1843 et seq.); Schulte/Welge, Der datenschutzrechtliche Kopieanspruch im Arbeitsrecht, NZA 2019, 1110 (1111 et seq.).
98
The contrary view, according to which Art. 15 (3) sentence 1 DSGVO merely regulates a special form of information, which only refers to the information to be provided pursuant to Art. 15 (1) DSGVO, is rejected. 1 of the GDPR and therefore cannot go further than the scope of this right of access, which is why the data subject can only request a copy of the information on whether his or her personal data are stored and, if so, what they are and/or only information on the information referred to in Art. 15(1)(a) to (h) of the GDPR (so-called restrictive interpretation),
99
cf. Nds. LAG, judgment of 9 June 2020 - 9 Sa 608/19 -, juris, para. 45; Paal, in: Paal/Pauly, DS-GVO, 3rd ed. 2021, Art. 15 para. 33; Franck, in: Gola, Datenschutz-Grundverordnung, 2nd ed. 2018, Art. 15 Rn. 27; Dausend, Der Auskunfts-anspruch in der Unternehmenspraxis, ZD 2019, 103; Wybitul/Brams, Welche Reichweite hat das Recht auf Auskunft und auf eine Kopie nach Art. 15 Abs. 1 DS-GVO? NZA 2019, 672,
100
the Senate does not follow. This view cannot be reconciled with the broad concept of personal data underlying the General Data Protection Regulation (cf. Art. 4 No. 1 DSGVO). Moreover, the wording as well as the meaning and purpose of Article 15 (3) sentence 1 GDPR do not speak for, but against such a restrictive interpretation. There are also no convincing arguments for this in the history and systematics of the Regulation.
101
The wording of Art. 15(3), first sentence, GDPR offers no reason to restrict the scope of the claim. Accordingly, the data subject has a right to "a copy of the personal data undergoing processing". For what reason only the data that can be gathered from the information of Article 15 (1) of the GDPR and the catalogue information of Article 15 (1) (a) to (h) of the GDPR should be included in the definition of "subject matter of the processing" is not clear. The first sentence of Article 15(3) of the GDPR makes no reference to this information, but speaks in general terms of the personal data that are the subject of the processing, without further limiting it. The wording thus goes beyond the data and information mentioned in Art. 15(1) DPA. This information is not the personal data itself, but other information relating to the data processing.
102
Cf. Schulte/Welge, Der datenschutzrechtliche Kopieanspruch im Arbeitsrecht, NZA 2019, 1110 (1111).
103
Thus, Article 15(1), second half-sentence of the GDPR states that the data subject has a right of access to such personal data and to the following information referred to in points (a) to (h).
104
Insofar as the defendant, with regard to the use of the phrase "personal data which are the subject of processing", believes that the term "subject", according to its literal sense, is to be understood in general linguistic usage in the sense of "subject" or "objective" and describes an abstract approach, and on the basis of this it takes the view that not all personal data, but only an aggregated overview can be the subject of the claim under Article 15(3), first sentence, GDPR, this is not convincing. This is because the term "subject matter" cannot be given exclusively the meaning assumed by the defendant. Rather, it is also used to designate the content of a certain process - in this case, data processing. Incidentally, the English-language version of Art. 15 para. 3 sentence 1 GDPR also speaks in favour of such an understanding and thus also in favour of the assumption that the claim under Art. 15 para. 3 sentence 1 GDPR extends to all personal data subject to processing. According to this, the right refers to "a copy of the personal data undergoing processing".
105
Cf. Bäcker, in: Kühling/Buchner, DS-GVO, BDSG, 3rd ed. 2020, Art. 15 para. 39a.
106
Similarly, the use of the indefinite article "a" before the word "copy" does not lead to the assumption that a - somehow - quantitative reduction of the requested copy(s) has to take place and that the provision of extensive data sets is excluded within the scope of the claim under Art. 15 (3) sentence 1 GDPR.
107
A. A. Wybitul/Brams, What is the scope of the right of access and the right to a copy under Article 15(1) of the GDPR?, NZA 2019, 672 (676).
108
This is because the phrase "a" does not mean a number word or a quantitative restriction (singular), but is merely an indefinite article without an independent meaning that makes a general statement about something that is known by its nature. This understanding is clarified by a comparison with the English language version, in which it is not "one copy" but "a copy". Unlike in the German language, there is a clearer distinction between the number word and the (indefinite) article.
109
The meaning and purpose of the right under Article 15(3), first sentence, of the GDPR also argue against a restrictive interpretation of the right to a copy of the personal data processed. The reason for and the regulatory objective of the General Data Protection Regulation is the protection of natural persons with regard to the processing of personal data concerning them, as guaranteed in Article 8(1) of the Charter of Fundamental Rights of the European Union (Charter of Fundamental Rights - CFR -) and in Article 16(1) TFEU (see Article 1(2) of the General Data Protection Regulation and Recital 1 to the General Data Protection Regulation). Already at the level of the Charter of Fundamental Rights, the right of every person to obtain information about the data collected concerning him or her and to obtain rectification of the data is enshrined (Art. 8 (2) sentence 2 CFR). The data subject rights of the General Data Protection Regulation are rooted in the consideration of the European standard-setter that the individual must in principle be able to determine the disclosure and use of his or her personal data. Natural persons should therefore in principle have control over their own data (cf. recital 7, sentence 2 to the GDPR). To this end, Art. 8 (2) sentence 2 CFR and Art. 15 (1) GDPR grant the data subject a right of access to which personal data has been collected by third parties. The aim is for the data subject to be aware of the processing and, on this basis, to be able to check its lawfulness (cf. recital 63, first sentence, to the GDPR).
110
It cannot be convincingly argued against this that precisely this objective expressed in the first sentence of recital 63 to the GDPR does not require the data subject to have access to all personal data subject to processing.
111
However, Wybitul/Baus, Wie weit geht das Recht auf Auskunft und Kopie nach Art. 15 DSGVO?, CR 2019, 494 (495); Wybitul/Brams, Welche Reichweite hat das Recht auf Auskunft und auf eine Kopie nach Art. 15 Abs. 1 DS-GVO?, NZA 2019, 672 (676); Paal, in: Paal/Pauly, DS-GVO BDSG, 3rd ed. 2021, Art. 15 Rn. 33a.
112
This is because the review of the lawfulness of the processing of personal data also includes the review of whether these data were processed correctly in terms of content. However, access to the processed personal data itself is already required for this. In addition, sentence 4 of recital 63 to the GDPR also speaks in favour of making the personal data accessible to the data subject. This is because according to this, the controller should, if possible, provide remote access to a secure system that would allow the data subject direct access to his or her personal data.
113
After all this, the right of access under Article 15(1) of the GDPR and the right to obtain a copy under paragraph 3 of the provision prove to be elementary, complementary data protection rights.
114
See also BVerwG, judgment of 16 September 2020 - 6 C 10.19 -, juris, para. 18: "Moreover, the right of access under Article 15(1) of the GDPR and the right to obtain a copy of the personal data which are the subject of the processing (Article 15(3) of the GDPR) are in a close internal regulatory relationship with the other data subject rights under Chapter III of the General Data Protection Regulation."
115
Moreover, only knowledge of whether, and if so to what extent and how, a controller processes personal data enables the data subject to exercise further rights in this respect. The right to information is intended to create transparency for the data subject and provide him or her with the knowledge base necessary to enforce this fundamental right.
116
Cf. BVerwG, judgment of 16 September 2020.
117
- 6 C 10.19 -, juris, para. 19; Franck, in: Gola, DSGVO, 2nd ed. 2018, Art. 15 para. 23; Ehmann, in: Ehmann/Selmayr, DSGVO, 2nd ed. 2018, Art. 15 para. 1.
118
By its nature, the claim is an instrument or a necessary step to enforce the other data subject rights such as rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) or compensation (Art. 82 GDPR).
119
Cf. BVerwG, judgment of 16 September 2020.
120
- 6 C 10.19 -, juris, marginal no. 19 with the remainder. Lembke, Der datenschutzrechtliche Auskunftsanspruch im Anstellungsverhältnis, NJW 2020, 1841 (1843).
121
This understanding is supported by the case law of the European Court of Justice on the previous legal situation under Article 12(a) of Directive 95/46/EC. With the General Data Protection Regulation, the European legislator intends to tie in with the objectives and principles of the Data Protection Directive (cf. recital 9 to the GDPR) and to ensure a uniform and high level of data protection for natural persons throughout the Union in the future (cf. recital 10 to the GDPR). Therefore, the characterisation of the right of access under Article 12(a) of Directive 95/46/EC made in the case law also offers indications as to the understanding of the right of access under Article 15(1) of the GDPR and the right to copy data under Article 15(3), first sentence, of the GDPR. Thus, the European Court of Justice has emphasised the instrumental character of the right of access for the data subject's request that the controller correct, erase or block his or her data.
122
Cf. on Art. 15(1) GDPR the reference in BVerwG, Judgment of 16 September 2020 - 6 C 10.19 -, juris, para. 20, to ECJ, Judgments of 7 May 2009 - C-553/07 -, Rijkeboer, para. 49 et seq, of 17 July 2014 - C 141/12 -, YS and others -, para. 44, and of 20 December 2017 - C-434/16 -, Nowak, para. 57.
123
On this basis, a narrow understanding of the right to copy data would run counter to the effectiveness of the GDPR. This is because in the event of a reduction of the right to the contents of Art. 15(1) GDPR, namely to information on whether personal data are processed, what they are and the catalogue information of Art. 15(1)(a) to (h) GDPR, the data subject would not be provided with the level of information he or she needs to effectively exercise his or her rights under Art. 16 to 21 GDPR.
124
The assumption of an independent claim from the first sentence of Article 15(3) of the GDPR, encompassing all personal data subject to processing, cannot be successfully countered with the argument that in this case the provision in Article 20 of the GDPR would no longer have any independent meaning and would thus be empty.
125
Article 20(1) of the GDPR grants the data subject, subject to the conditions set out therein, a right to, inter alia, obtain the personal data relating to him or her that he or she has provided to a controller in a structured, commonly used and machine-readable format. This right is directed at the provision of a format that enables immediate further processing.
126
Cf. Dix, in: Simitis/Hornung/Spiecker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 20 Rn. 11; Bäcker, in: Kühling/Buchner, DS-.
127
GVO, BDSG, 3rd ed. 2020, Art. 15 Rn. 39a.
128
The claim under Article 15 (3) sentence 1 of the GDPR, on the other hand, only includes the provision of a copy. In addition, under the conditions of Article 15 (3) sentence 3 of the GDPR, the provision of the data in a standard electronic format is (also) possible. A transmission in the form of a pdf document, for example, would meet these requirements. In contrast, this form of transmission would not meet the obligations under Article 20 (1) of the GDPR because it does not enable - immediate - further processing.
129
Art. 20(1)(b) GDPR also requires that the processing is carried out with the help of automated procedures. It is also not directed at the production of a copy, but at the surrender of the data itself.
130
The fact that the GDPR contains the term "all data" in other provisions - such as Art. 28(3)(g) GDPR cited by the defendant - does not mean that the EU legislator intended the wording chosen in Art. 15(3) first sentence GDPR (a copy of "the" personal data) to cover only certain data. Irrespective of the question whether Art. 28 GDPR is not already unsuitable for the interpretation of the right of the data subject under Art. 15 (3) sentence 1 of the GDPR due to its systematic position in Chapter IV. 3 sentence 1 GDPR, the use of the adverb "all" in Art. 28(3)(g) GDPR alone does not allow for a firm conclusion that the use of "the" in Art. 15(3) sentence 1 GDPR is intended to mean that this provision only applies to certain personal data.
131
In this respect a. A. Wybitul/Baus, Wie weit geht das Recht auf Auskunft und Kopie nach Art. 15 DSGVO?, CR 2019, 494 (495).
132
The same applies to Article 58(1)(e) of the GDPR cited by the defendant.
133
Finally, the history of the Regulation does not require a restrictive interpretation of Art. 15(3), first sentence, GDPR. This is because it is unproductive for the interpretation. In particular, the legislative history of the General Data Protection Regulation does not provide sufficient evidence that the legislator, when creating the first sentence of Article 15(3) of the General Data Protection Regulation, was motivated by the objective of limiting the right to a free copy to the information and/or data to be provided pursuant to Article 15(1) of the General Data Protection Regulation.
134
Nothing to the contrary can be inferred from the amendment of the heading of Art. 15 GDPR during the legislative procedure. The fact that the final version of this heading no longer contains the term "right of surrender" does not mean that the legislator deliberately decided against a right to surrender a copy of the data.
135
Admittedly, Art. 15 GDPR was amended in the Legislative Resolution of the European Parliament of 12 March 2014 (P7_TA-PROV(2014)0212) - knowing the proposal of the European Commission of 25 January 2012 (COM(2012)0011), in which Art. 15 neither had a heading nor contained any form of a right of access - was entitled "Data subject's right of access and of access to data" (cf. amendment 111), whereas Art. 15 DDA in its version applicable as of 25 May 2018 is now (only) entitled "Data subject's right of access". However, Art. 15 DDA in the version of the Legislative Resolution of 12 March 2014 did not (yet) contain a right to data copy corresponding to Art. 15(3) sentence 1 DDA, but still included in Art. 15(2a) the right to data portability - now anchored independently in Art. 20 DDA. Another argument against the assumption that the amendment history of the heading of Art. 15 GDPR is of decisive weight for determining the scope of the content of the right under Art. 15 (3) sentence 1 GDPR is that Art. 20 GDPR in its current version is also not titled "right of surrender" or similar, but is titled "right to data portability", although this is a claim to surrender and transfer of data.
136
Cf. Dausend, Der Auskunftsanspruch in der Unternehmenspraxis, ZD 2019, 103 (106).
137
Nor is the case law of the European Court of Justice in its judgment of 17 July 2014 - C-141/12 et al. -, YS et al., on Article 12(a) of Directive 95/46/EC decisive for the interpretation of the content of the claim under Article 15(3), first sentence, GDPR. Insofar as the representatives of the restrictive interpretation in particular assume that the European legislator did not want to create a separate right to copies in response to this decision, but instead deliberately decided not to apply the right to copies to all personal data, this is already not convincing because the European Court of Justice in this decision dealt with the scope of the right to information under Article 12(a) of Directive 95/46/EC, which did not (yet) contain a right to the surrender of a copy of data within the meaning of Article 15(3) of the GDPR. Only in this respect did the European Court of Justice rule that, in order to safeguard the right of access under Article 12(a) of Directive 95/46/EC and Article 8 of the CFR, it was sufficient for the applicant to receive a complete overview of all personal data concerning him that were the subject of processing in an intelligible form, i.e. in a form that enabled him to take cognisance of these data and to check whether they were correct and processed in accordance with the Directive, so that he could, if necessary, exercise the rights conferred on him by the Directive. To the extent that the objective pursued by the right of access could be fully achieved by another form of communication, the data subject had no right under either Article 12(a) of Directive 95/46/EC or Article 8(2) of the CFR to obtain a copy of the document or original file containing those data. In order for the data subject not to have access to information other than the personal data concerning him or her, he or she could obtain a copy of the document or the original file in which that other information had been obliterated.
138
See ECJ, Judgment of 17 July 2014 - C 141/12 and others -,YS and others, paras 58 and 60.
139
There is also no evidence that the European legislator, in reaction to this ECJ judgment, deliberately decided in its final decision with regard to the provision in Article 15 (3), first sentence, of the GDPR not to apply the right to copy to all personal data. In this respect, it could also be argued that, on the contrary, the legislator deliberately created an unrestricted right to copy data in Article 15 (3) sentence 1 of the GDPR in response to the Supreme Court decision. In this context, it must also be taken into account that the Court of Justice stated in the judgment that a complete overview of the data in an intelligible form (only) suffices to safeguard the right of access if it enables the data subject to become aware of these data and to check whether they are correct and are processed in accordance with the Directive, so that he or she can, if necessary, exercise the rights conferred on him or her.
140
See ECJ, Judgment of 17 July 2014 - C 141/12 and others -, YS and others, paras 57 and 59.
141
The other arguments put forward by the defendant against an extensive interpretation of Article 15 (3) sentence 1 GDR are also unsuccessful. To the extent that it argues that the transmission of a volume of data - as requested by the plaintiff - proves to be highly unstructured and non-transparent and thus contradicts the principle of communication in an intelligible form following from Art. 12 (1) sentence 2 GDPR, this is not convincing, if only against the background of the fact that Art. 12 (1) of the GDPR is a protective provision for the data subject, in accordance with its wording and its systematic position in Chapter III, already according to its heading ("Rights of the data subject"), and it is not evident why a restriction of data subject rights should be derived from this. Furthermore, the Senate is unable to see in this case to what extent the exam clauses prepared by the plaintiff, together with the examiner's report, should constitute an unstructured and non-transparent amount of data.
142
Similarly, a restrictive interpretation of Article 15(3) sentence 1 of the GDPR is not necessary in order to prevent the claim for surrender of a copy from being asserted for purposes unrelated to data protection. Irrespective of how a "non-privacy purpose" is to be precisely defined and, if necessary, determined, such a purpose is ruled out with regard to the conduct of any examination proceedings - cited by the defendant - with regard to the plaintiff, for the very reason that the assessment of his exam clauses has not been challenged by him, but has become final.
143
The fear of a possible "proliferation" of the scope of the claim under Article 15(3) sentence 1 of the GDPR is also unconvincing. The EU legislator has recognised that the right to information may require the processing of a large amount of data. In this respect, the seventh sentence of recital 63 to the GDPR states that if the controller processes a large amount of information about the data subject, it should be able to require that the data subject specify to which information or which processing operations his or her request for information relates. Moreover, according to Art. 12(3), second sentence, the one-month information period may be extended by a further two months in this respect, if this is necessary taking into account the complexity and the number of requests.
144
The right to copy data enshrined in Art. 15(3), first sentence, GDPR does not conflict with the principle of data minimisation (cf. Art. 5(1)(c) GDPR). This principle relates to data processing and is, in relation to the extent of the data, an outflow of the principle of necessity. However, the creation of the copies in question here does not process any new data, but merely duplicates or duplicates existing data. However, the copy is made available to the data subject - who is to be protected - at his or her request, without it having to or having to remain with the data controller. Finally, Article 15(4) of the GDPR does not support a restrictive interpretation of Article 15(3), first sentence, of the GDPR. According to this provision, the right to receive a copy must not affect the rights and freedoms of other persons. This provision is a case-by-case restriction. For this reason alone, it cannot be used for a restrictive interpretation of Article 15 (3) sentence 1 of the GDPR.
145
The plaintiff's claim under Article 15(3), first sentence, in conjunction with Article 12(5), first sentence, of the GDPR for a free copy of his examination papers from the second state examination together with an examiner's report is also not excluded. in conjunction with Article 12(5), first sentence, of the GDPR to a free copy of his examination papers from the second state examination together with the examiner's report is also not excluded. It neither interferes with the rights and freedoms of other persons under Article 15(4) of the GDPR (see a)), nor is it an excessive request within the meaning of Article 12(5), first sentence, of the GDPR (see b)). An exclusion also does not follow from an analogous application of Art. 14(5)(a) or (b) GDPR (see c)).
146
a) The claim of the plaintiff is not limited or excluded by Art. 15(4) GDPR. According to this provision, the right to receive a copy pursuant to Article 15(3), first sentence, GDPR may not affect the rights and freedoms of other persons. According to the fifth sentence of recital 63 to the GDPR, rights and freedoms are primarily understood to mean trade secrets and intellectual property rights (in particular copyright in software).
147
Cf. Dix, in: Simitis/Hornung/Spieker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 15 marginal no. 34; Schmidt-Wudy, in: BeckOK Datenschutzrecht Wolff/Brink, 36th edition, as of 1 May 2021, Art. 15 marginal no. 96.
148
In particular, the fact that the corrections of the examiners and their expert opinions are also published does not prevent the plaintiff's claim. For these are produced from the outset with the proviso that they are made accessible to the examinee upon request. For this reason alone, the examiner has no right to confidentiality of his assessment,
149
cf. also ECJ, Judgment of 20 December 2017.
150
- C-434/16 -, Nowak, juris, paras. 42 to 44,
151
which, according to Article 19 (4) of the Basic Law, must be accessible to a review, which in turn requires prior knowledge by the examinee.
152
b) Nor does Article 12 (5) sentence 2 of the GDPR preclude the right to a free copy. According to this provision, in the case of manifestly unfounded or - especially in the case of frequent repetition - excessive requests by a data subject, the controller may either demand reasonable remuneration (Art. 12(5) second sentence (a) GDPR) or refuse to act on the request (Art. 12(5) second sentence (b) GDPR). According to Art. 12(5), third sentence, the controller must provide evidence of the manifestly unfounded or excessive nature of the request.
153
A case of Art. 12(5) sentence 2 GDPR is not given, let alone proven by the defendant.
154
The assertion of the claim under Article 15(3), first sentence, in conjunction with Article 12(5), first sentence, of the GDPR by the plaintiff is not proven. in conjunction with the first sentence of Article 12(5) of the GDPR does not prove to be manifestly unfounded, as can already be seen from the administrative court's decision upholding the claim.
155
In this context, see also Dix, in: Simitis/Hornung/Spieker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 12 marginal no. 32; Heckmann/Pasche, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, 2nd ed. 2018, Art. 12 marginal no. 43; Paal/Hennemann, in: Paal/Pauly, DS-GVO BDSG, 3rd ed. 2021, Art. 12 marginal no. 65.
156
It cannot be established that the plaintiff's request is excessive. Nor can anything else be assumed because the request is for a copy of 348 pages (copy of eight examination papers plus examiners' reports, which have an average of 43.5 pages in total). A request is not excessive solely because of a high processing effort. Rather, it is necessary for the applicant to have abused his or her rights, which may, for example, be based on the harassing assertion of a data subject's right with the aim of damaging the person responsible.
157
Cf. Bäcker, in: Kühling/Buchner, DS-GVO, BDSG, 3rd ed. 2020, Art. 12 marginal no. 37; Paal/Hennemann, in: Paal/Pauly, DS-GVO BDSG, 3rd ed. 2021, Art. 12 marginal no. 66; Quaas, in: BeckOK Datenschutzrecht Wolff/Brink, 36th edition as of 1 May 2021, Art. 12 marginal no. 43 et seq.
158
The Senate does not assume that the fulfilment of the plaintiff's claim requires a disproportionately high processing effort. The assertion of the claim does not cause the defendant any disadvantages in the specific individual case that are disproportionate to the importance of the claim for the plaintiff. The application in dispute comprises - as stated - 348 pages to be copied. The effort to take these pages from the plaintiff's file, to unclip them if necessary, to copy or digitise them and to send them to the plaintiff does not constitute an excessive burden. Due to the plaintiff's request, which was clearly specified by the requests of 11 and 25 October 2018 and is easy to grasp, the defendant is neither required to first examine in detail what the request refers to, nor which of the plaintiff's data are contained in which file systems. Moreover, with regard to the examinations and examiners' reports, it is not necessary to determine extensively whether these data records contain information about (other) persons that may be worthy of protection. On the contrary, in the present case, there are indications that filtering out and compiling individual data from the plaintiff's file - as the defendant would probably consider more appropriate - would lead to a greater burden on the State Judicial Examination Office.
159
Moreover, the plaintiff's request for information differs considerably from other legal disputes - e.g. decided in civil and labour courts - in which, on the basis of an unsubstantiated argument, personal data of the person concerned had to be searched for in all servers, databases, web applications, email mailboxes, directory structures, storage media, smartphones, notebooks and various other end devices of the person responsible, together with all superiors and colleagues.
160
Cf. e.g. ArbG Düsseldorf, judgment of 5 March 2020 - 9 Ca 6557/18 -, juris, marginal no. 92.
161
Insofar as the defendant fears a large number of applications under Article 15(3), first sentence, Article 12(5), first sentence, GDPR by former as well as future examination graduates (potentially approx. 2,500 applications of the current examination year and approx. 12.500 applications of the past five examination years) and expects an increased personnel expenditure (requirement of the creation of up to three additional positions), a threatening cost burden as well as a jeopardisation of the course of the examination procedure as a result, this argument already lacks the individual case reference required for a finding of abusive conduct on the part of the plaintiff.
162
There is also nothing to show that the applicant is asserting the application in an abusive or vexatious manner, namely with the aim of damaging the responsible party. In principle, abusive conduct cannot be justified solely on the basis of the consequences that typically occur when exercising the right under Article 15(3), first sentence, of the GDPR. Depending on the type, duration and intensity of the relationship between the person requesting information affected by the data processing and the controller, such consequences may include quite considerable amounts of data, copies of which must be sent, and thus a considerable administrative burden.
163
Cf. Schmidt-Wudy, in: BeckOK Datenschutzrecht Wolff/Brink, 36th edition, as of 1 May 2021, Art. 15 marginal no. 85.
164
The Senate leaves open whether the exceptional circumstances of Art. 12 (5) sentence 2 GDPR also include cases in which the data subject, in exercising the claim under Art. 15 (3) sentence 1 GDPR, pursues solely or predominantly non-data protection purposes.
165
Cf. Schmidt-Wudy, in: BeckOK Datenschutzrecht Wolff/Brink, 36th edition, as of 1 May 2021, Art. 15 marginal no. 85; Lembke, Der datenschutzrechtliche Auskunftsanspruch im Anstellungsverhältnis, NJW 2020, 1841 (1843 et seq.); on the abuse of rights in the freedom of information law see. BVerwG, Judgment of 24 November 2020 - 10 C 12.19 -, juris, para. 10 et seq.
166
This is because there are no reliable indications that the plaintiff is pursuing unlawful objectives, which, moreover, would require proof pursuant to Article 12 (5) sentence 3 of the GDPR. Such indications cannot be derived from the fact that the plaintiff can, in principle, also take note of the content of the supervisory papers and examiners' reports with a view to proceedings under examination law by sending a copy. The latter is only a consequence of the fact that the right to a copy under Article 15(3) sentence 1 of the GDPR and the right of inspection under § 23(2) of the JAG NRW in principle comprise the same data and can be asserted side by side. In addition, the plaintiff has no right to take legal action under examination law because the assessment of his examinations has become final (see 2.).
167
c) The claim is also not covered by Article 14 (5) letter b) alt. 2 GDPR by analogous application. This provision, according to which paragraphs 1 to 4 of Art. 14 GDPR do not apply if and to the extent that the provision of this information would require a disproportionate effort, is not applicable mutatis mutandis within the framework of Art. 15 (3) first sentence GDPR. It is not apparent that there is an unintended regulatory gap in this regard. This is already contradicted by the fact that Article 15 DPA immediately follows the provision of Article 14 DPA, with which the legislator made it clear that in certain cases it saw the risk of a disproportionate effort and the resulting burden for the controller.
168
See also Bergmann/Möhrle/Herb, Datenschutz-recht, 60th EC August 2020, Art. 15 DSGVO marginal no. 129; Dix, in: Simitis/Hornung/Spieker, Datenschutzrecht, DSGVO mit BDSG, 2019, Art. 15 marginal no. 36; Schulte/Welge, Der datenschutz-rechtliche Kopieanspruch im Arbeitsrecht, NZA 2019, 1110 (1114).
169
There should also not be a comparable interest situation, as Art. 14 GDPR concerns cases in which so many persons would have to be informed that this would mean a disproportionate effort. Unlike Art. 15 GDPR, it is not the provision of information as such that is costly. Rather, the disproportionate effort results from the large number of persons to be informed, which is difficult to manage.
170
Cf. Schulte/Welge, Der datenschutzrechtliche Kopieanspruch im Arbeitsrecht, NZA 2019, 1110 (1114).
171
For the reasons already mentioned, an analogous application of Article 14(5)(a) of the GDPR in the context of Article 15 of the GDPR is also out of the question. Moreover, it is not recognisable that the plaintiff already has the requested information within the meaning of this provision. The defendant's offer to inspect the examination papers and the examiners' reports at the State Judicial Examination Office and/or the production of a copy for a fee does not fulfil the claim under Article 15(3), first sentence, GDPR.
172
The plaintiff's claim under Article 15(3), first sentence, in conjunction with Article 12(3), first sentence, does not satisfy the claim under Article 15(3), first sentence. In conjunction with Article 12(5), first sentence, of the GDPR, there is also no restrictive provision. Such a restriction results neither from Section 12 of the North Rhine-Westphalia Data Protection Act (see a)) nor from other national regulations within the meaning of Article 23 of the Regulation (see b)), which are the only ones considered in this case.
173
a) Pursuant to the first sentence of Section 12(1) of the NRW Data Protection Act, if the controller processes large amounts of information about the data subject, the controller may, in the event of a request for information, require the data subject to specify which information and which processing operations the request for information relates to. Irrespective of the question whether the personal data of the plaintiff processed by the State Judicial Review Board are large amounts of information at all, the plaintiff - as already stated - has precisely asserted his request in accordance with § 12.1 sentence 2 of the NRW Data Protection Act.
174
Nor does § 12.2 sentence 1 no. 2 of the NRW Data Protection Act preclude the provision of the requested copy. According to this provision, the provision of information may be refused insofar and as long as the information would endanger public security or otherwise be detrimental to the welfare of the Federation or a Land.
175
Accordingly, the prerequisite is that the disclosure of the content of the information itself leads to the assumption of a threat in the aforementioned sense. This is supported not only by the wording of Section 12 (2) sentence 1 no. 2 DSG NRW ("the information") but also by systematic considerations. For if Section 12 (1) of the NRW Data Protection Act is already intended to serve the preservation of the functioning of public authorities in the sense of protection against overflow,
176
cf. LT-Drs. 17/1981, p. 140,
177
it cannot be assumed that the offences under Section 12(2), first sentence, nos. 1 to 3 of the NRW Data Protection Act also pursue (only) the same regulatory purpose in this respect and are merely aimed - just like Section 12(1) of the NRW Data Protection Act - at a threat to the aforementioned objects of protection due to a very high processing effort, e.g. because of particularly large amounts of data.
178
b) A limitation of the plaintiff's claim also does not follow from other national regulations within the meaning of Article 23 GDPR. Pursuant to Article 23(1) of the GDPR, the rights under Article 15 of the GDPR may, inter alia, be restricted by legislative measures of the Union or the Member States, provided that such a restriction respects the essence of fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society. In addition, the legislative measure must secure one of the objectives referred to in points (a) to (j). In addition, any such legislative measure must, in accordance with Article 23(2) of the GDPR, in particular contain, where appropriate, specific provisions at least in relation to the requirements set out in points (a) to (h) of that Article.
179
Section 23(2) JAG NRW, which is also to be examined in this context, is not a Member State legislative provision restricting the right under Article 15(3), first sentence, Article 12(5), first sentence, GDPR within the meaning of Article 23(1) GDPR.
180
As already explained, Section 23(2) JAG NRW does not have a restrictive character with regard to the claim under Article 15(3), first sentence, Article 12(5), first sentence, GDPR (see II. 1. c)). Rather, the claims resulting from these provisions stand side by side.
181
For the reasons also set out in II. 1. c), the provisions of the law on fees referred to by the defendant for the requested fee of 69.70 euros in conjunction with § 23.2 JAG NRW are also not legal provisions restricting the right to the transmission of a free copy within the meaning of Article 23 GDPR.
182
Against this background, the Senate does not need to decide whether the requirements of Article 23(1) of the GDPR would apply and whether or to what extent the formal requirements of Article 23(2) of the GDPR would be met.
183
The plaintiff's claim to the provision of a (first) free copy has not been extinguished through fulfilment.
184
In the present case, fulfilment does not result in particular from Art. 15 (3) sentence 2 GDPR. According to this provision, the controller may demand a reasonable fee based on the administrative costs for all further copies (beyond the first copy) requested by the data subject.
185
The copy requested by the plaintiff of his supervisory papers and the examiners' reports is not a further copy in this sense. In this regard, the plaintiff cannot be successfully argued that he already has a "first" (free) copy by asserting the claim under section 23 (2) JAG NRW and the accompanying option to take photos of the examinations and examiners' reports or to have a copy made for a fee. Regardless of the fact that he has not yet made use of this option, he has not been provided or offered a copy of the data within the meaning of Article 15 (3) sentence 1 of the GDPR. A photograph or a copy for which a charge is made by the State Judicial Review Board could provide the plaintiff with knowledge of the content of the data. However, against the background that the two information claims - as stated (see II. 1. c)) - pursue different goals and the right of inspection is not an equivalent to the data copy, this is irrelevant and does not lead to the claim under Art. 15 (3) sentence 1 GDPR being fulfilled.
186
Fulfilment also does not follow from a corresponding application of Art. 14(5)(a) GDPR, according to which paragraphs 1 to 4 of Art. 14 GDPR do not apply if and to the extent that the data subject already has the information. As explained (see II. 3. c)), this exception is not applicable by analogy in the context of Art. 15 (3) sentence 1 GDPR.
187
With regard to the (still) necessary fulfilment of the claim to which the plaintiff is entitled under Article 15(3), first sentence, Article 12(5), first sentence, GDPR, the defendant has the choice whether to provide the plaintiff with the free copy in paper form or whether to provide him with the data in a standard electronic format. If, as in the present case, no electronic request has been made, which would regularly oblige the controller to provide the information electronically pursuant to Article 15(3), third sentence, of the GDPR, the controller generally has discretion under Article 12(1), second sentence, of the GDPR as to the form in which it provides the information.
188
Cf. Bäcker, in: Kühling/Buchner, DS-GVO, BDSG 3rd ed. 2020, Art. 12 marginal no. 16 and Art. 15 marginal no. 44a; Schmidt-Wudy, in: BeckOK Datenschutzrecht, Wolff/Brink, 36th ed. 2021, Art. 15 marginal no. 83.
189
Based on this, the Senate does not see any reason to obtain a preliminary ruling from the ECJ pursuant to Article 267 TFEU, inter alia, with regard to the interpretation of Article 15 (3) sentence 1 of the GDPR, as suggested by the defendant.
190
III The decision on costs follows from § 154 (2) VwGO, the decision on provisional enforceability from § 167 (1) sentence 1 and (2) VwGO in conjunction with § 708 no. 10, § 711 sentences 1 and 2 and § 709 sentence 2 ZPO.
191
IV. The appeal is to be allowed on the grounds of fundamental importance of the case pursuant to § 132.2 no. 1 VwGO. In particular, the scope of the right under Article 15(3) sentence 1 of the GDPR is of fundamental importance. The primary and secondary provisions of Union law are part of the revisable federal law within the meaning of § 137 (1) VwGO even if they are only relevant to the decision by way of a Land law application order.
192
Cf. BVerwG, decision of 11 March 2020.
193
- 5 B 5.20 -, juris, marginal no. 14.
