Banner2.png

BFH - IX R 25/22

From GDPRhub
Revision as of 15:27, 11 March 2025 by Tjk (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
BFH - IX R 25/22
Courts logo1.png
Court: BFH (Germany)
Jurisdiction: Germany
Relevant Law: Article 15 GDPR
Article 14(5)(b) GDPR
Article 12(5)(b) GDPR
Article 23(2)(c) GDPR
§ 32c AO
Decided: 14.01.2025
Published: 08.03.2025
Parties:
National Case Number/Name: IX R 25/22
European Case Law Identifier: ECLI:DE:BFH:2025:U.140125.IXR25.22.0
Appeal from: FG Thüringen
4 K 660/20
Appeal to: Unknown
Original Language(s): German
Original Source: BFH (in German)
Initial Contributor: tjk

A court held that a controller could not reject an access request by claiming that providing access would involve a disproportionate effort. Further, it found an access request not to be excessive if the data subject requests all available information regarding its personal data without limiting this request.

English Summary

Facts

It is disputed to what extent the plaintiff (data subject) can demand information from the tax office (the controller) in accordance with Article 15 GDPR.

The data subject requested "the disclosure of copies of all stored information" relating to him with reference to the GDPR, whereupon the controller sent various overviews. In this regard, the data subject complained that not all relevant documents had been made available in accordance with Article 15 GDPR. The controller interpreted this as a request for comprehensive inspection of the files, which was officially approved. The data subject then requested information pursuant to Article 15 GDPR. The controller declared its willingness to allow the inspection of the files to fulfill the access request. However, the sending of all files was refused.

Before the Thuringian Fiscal Court (Thüringer Finanzgericht - FG Thüringen) the data subject pursued his access request under Article 15(1) GDPR and the provision of copies pursuant to Article 15(3) GDPR. The controller sent the data subject various overviews during the legal proceedings. The FG dimissed the data subject's claims. After that the data subject was granted access to the files concerning the proceedings.

With the appeal to the Federal Finance Court (Bundesfinanzhof - BFH), the data subject complained that the access request was not yet fulfilled. It claimed, that the listing of internal agency processes does not constitute the provision of information and that the access request cannot be countered with the objection of disproportionate effort.

The controller requested that the appeal be dismissed because the access request had already been complied with and because Article 15 GDPR does not give rise to any further right to full access to the files.

Holding

The court held, that the first instance court had erred in assuming that the controller could object to the access request on the grounds that the required provision of information would involve disproportionate effort and that the access request was excessive. Thus, the court referred the case back to the first instance court.

1. Right of access

The court upheld the first instance court's finding that insufficient information given by the data subject does not justify a rejection of the access request within the meaning of Article 15 GDPR despite the directory provision of Section 32c(2) of the German Fiscal Code (Abgabenordnung - AO) stating that the data subject must specify in detail the type of personal data about which information is to be provided.

The court held, that this provision does not provide for a loss of the right to access or a right to refuse it. Against the background of Article 23(2)(c) GDPR, however, this would be necessary for assuming a corresponding legal consequence. According to this provision, any norm that restricts the right to access under Article 15 GDPR must at least regulate the scope of the restriction made.

2. No exemption due to disproportionate effort

The court found, that regardless of the fact that there is no evidence of disproportionate expenditure on the part of the controller in this case, a corresponding restriction of the right to access does not arise from the GDPR generally.

The court stated, that such an exemption follows from Article 14(5)(b) GDPR. However, the court held, that this only applies to the obligation to provide information within the meaning of Article 14 GDPR. The court ruled out an analogous application of Article 14(5)(b) GDPR to an access request as it found neither an unplanned regulatory gap nor a comparable situation of interests.

The court found - based on the EDPB Guidelines 01/2022 - that Article 12 GDPR and the right to access is not subject to the general reservation of proportionality with regard to the efforts of the controller to comply with the request. Thus, the court - drawing on CJEU - C‑307/22 - FT (Copies of medical records) - found that Article 15(4) GDPR restricts the right to access only with regard to the rights of third parties, but not with regard to the effort involved for the controller in protecting the rights of third parties.

The court also rejected that such an objection arises from Recital 63 GDPR which states that the controller should be able to demand that the data subject specify which information or processing operations their request relates to. The court held that recitals are not legally binding and thus cannot be used either to deviate from the provisions in a way that is obviously contrary to their wording.

The court also held, that a restriction of the right to access in the event of disproportionate effort does not arise from the provisions of national law.

3. Meaning of excessive within Article 12(5) GDPR

The court held, that an access request cannot be considered excessive if the data subject does not restrict its request in terms of content or time. The broad scope of Article 15(1) GDPR would be contradicted if the controller could refuse to provide information if the data subject asserts his or her right to access without restriction.

Additionally the court found that a request cannot be deemed excessive just because the controller offered the data subject the opportunity to inspect the files. The court found the opportunity to inspect the files to be an aliud compared to the request for a copy of personal data because it is aimed neither at the permanent transfer of personal data nor at providing information and making copies available.

Neither, the court held, can it be relevant for the assumption of excess that the data subject is pursuing purposes other than those served by the GDPR.

4. When is an access request fulfilled?

The court found that an access request cannot be already fulfilled if the controller retained certain information because it mistakenly assumed that it is not obliged to provide it.

The court stated, that if the controller in the case at hand has declared - at least implicitly - that it has provided the information completely and correctly, the request is fulfilled, provided that the first instance court has no doubts about the correctness of the declaration. In particular the court pointed out that the right to access was not fulfilled by granting access to the files.

The court concluded, that if the first instance court finds that the controller has not yet declared - at least implicitly - that it has fully fulfilled the data subject's access request or that there is reason to believe that the information was not provided with the necessary care, it must oblige the controller to provide the requested information.

Comment

The court stated that it does not find it necessary to refer the case to the CJEU under Article 267(3) TFEU as it found the legal situation clear or already clarified by the CJEU's case law in a way that leaves no reasonable doubt ("acte éclairé").

In particular, the court stated that in view of the clear wording of Article Article 14(5)(b) GDPR and Article 15(3) and (4) GDPR the access request cannot be countered with the objection of disproportionate effort associated with providing the information. Even if a corresponding statement can be found in Recital 63 GDPR, the court was convinced that no general legal principle valid for the request under Article 15 GDPR can be derived from this. The case law of the CJEU has also clarified that the reasons for refusing an access request under Article 12(5)(b) GDPR require an abusive conduct and that the access request about the personal data processed does not require any justification .

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details. 

Judgment of January 14, 2025, IX R 25/22

No right to refuse information under Art. 15 GDPR if the effort involved is disproportionate

ECLI:DE:BFH:2025:U.140125.IXR25.22.0

BFH IX. Senate

EUV 2016/679 Art 15 para. 1, EUV 2016/679 Art 15 para. 3, EUV 2016/679 Art 15 para. 4, EUV 2016/679 Art 14 para. 5, EUV 2016/679 Art 12 para. 5, AO § 32c para. 1 no. 3, AO § 32c para. 3, BGB § 275 para. 2, BGB § 259 para. 2, BGB § 260 para. 2, TFEU Art 267 para. 3

previous Thuringian Finance Court, February 22, 2022, Ref. No. 4 K 660/20
Principles

1. The controller cannot object to the right to information under Art. 15 of the General Data Protection Regulation on the grounds that the information would require disproportionate effort.

2. A request for information is not considered excessive if the person concerned requests information about their personal data without limiting this request in terms of content or time.

3. A right to information is generally fulfilled if, according to the declared will of the person obliged to provide the information, the information represents the information in the entire scope owed.

Tenor

On the plaintiff's appeal, the judgment of the Thuringian Finance Court of February 22, 2022 - 4 K 660/20 is overturned.

The matter is referred back to the Thuringian Finance Court for further hearing and decision.

The decision on the costs of the proceedings is transferred to the court. Facts
I.

It is disputed to what extent the plaintiff and appellant (plaintiff) can demand information from the defendant and respondent (tax office - tax office) in accordance with Art. 15 of the General Data Protection Regulation (GDPR).

The plaintiff is a board member of a stock corporation (Z-AG). He was also involved in a related atypically silent partnership (Z-atypically silent). The plaintiff's attorney requested "the provision of copies of all stored information" of Z-AG with reference to the General Data Protection Regulation, whereupon the tax office sent various overviews (basic data, decision data, e-data) in a letter dated May 8, 2020. In this regard, the attorney complained that not all documents to be submitted in accordance with Art. 15 GDPR that were available to the tax authorities had been made available. The tax office interpreted this as a request for comprehensive inspection of the files, which was approved by the office. The attorney then requested information pursuant to Art. 15 GDPR regarding the plaintiff. The tax office declared its willingness to inspect the files in order to fulfill the request for information. However, the sending of all files was refused.

With his action brought against this at the tax court (FG), the plaintiff pursued his request for information pursuant to Art. 15 Para. 1 GDPR and for the provision of copies of his personal data pursuant to Art. 15 Para. 3 GDPR. In a written submission dated July 21, 2021, the tax office sent the plaintiff various overviews with regard to the Z-atypically silent during the legal proceedings in order to provide information pursuant to Art. 15 GDPR. In the first instance proceedings, the plaintiff requested that the tax office be ordered to provide him with information about these personal data and the following information (Article 15 paragraph 1 GDPR):

- 

"the purposes of the processing;

- 

the categories of personal data being processed;

- 

the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

- 

if possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria for determining that period;

- 

the existence of a right to rectification or erasure of the personal data concerning him or her or to restriction of processing by the controller or a right to object to such processing;

- 

the existence of a right to lodge a complaint with a supervisory authority; if the personal data are not collected from the data subject, all available information on the origin of the data;

- 

the existence of automated decision-making, including profiling, pursuant to Article 22 paragraphs 1 and 4 and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for the data subject."

The plaintiff also applied to the FG to order the tax office to provide him with a copy of the personal data that are the subject of the processing.

The following information was expressly excluded by the plaintiff from the request for information:

- 

"which the plaintiff has gathered from correspondence between the defendant and the plaintiff personally and from correspondence between the defendant and one of the tax consultants, lawyers or a corresponding professional association;

- 

which are only stored by the defendant because they cannot be deleted due to the statutory retention period; however, this does not include data that is relevant for determining a period that has not yet expired;

- 

which are subject to the restrictions of Art. 2 Para. 2 Letter d GDPR;

- 

which have already been issued with the transmission in the written submission dated July 21, 2021, i.e. basic data overview, notice data overview, e-data overview;

- 

the tax notices that concern the plaintiff personally;

- 

the tax assessments concerning the company(s) that the plaintiff personally represents."

The action was unsuccessful (Decisions of the Financial Courts 2022, 1347).

On September 1, 2022, the plaintiff was granted access to the files concerning the objection proceedings of Z-AG.

With the appeal, the plaintiff complains of the violation of substantive law (Art. 15 GDPR) and procedural errors. The request for information is also aimed in particular at the provision of copies of personal data. This has not yet been done - not even partially. The listing of internal agency processes whose content is not clear does not constitute the provision of information. The request for information cannot be countered with the objection of disproportionate effort. Furthermore, his request for information cannot be described as excessive. In addition, a claim for damages in the amount of € 450 is being made due to of the costs incurred in connection with the inspection of the files. This is included as a minus in the already asserted right to information. His right to data protection is one of the protected human rights and is specified by the General Data Protection Regulation. In the decision of the Federal Finance Court (BFH) of March 12, 2024 - IX R 35/21 (intended for official publication, BStBl II 2024, 682), the term "indispensability" is interpreted as if the burden of proof rests on the taxpayer. However, the Court of Justice of the European Union (ECJ) formulates this in such a way that the person obliged to provide information must copy the entire file if it is essential for him to be able to provide the information correctly and completely. The BFH's requirement that the applicant must demonstrate the indispensability is a further requirement not included in the General Data Protection Regulation. The rule-exception principle adopted by the BFH is also not shared by the ECJ. This corresponds to the fact that an application under Art. 15 GDPR does not have to be justified by the applicant. Every request for information imply that the applicant wishes to assert all of his rights under the General Data Protection Regulation. This also applies to him, the plaintiff. The distinction made by the BFH between "copy of the personal data" and "copy of the source in which the personal data is processed" is incomprehensible. Furthermore, the provision of copies of the files containing personal data is essential to fulfill his right to information.

The plaintiff requests that
the judgment of the lower court be overturned and the action granted on the condition that no further information is requested regarding the information that is already contained in parts of the files that became known through the inspection on September 1, 2022.

Furthermore, the plaintiff requests that

the tax office be ordered to pay damages in the amount of €450.

The tax office requests that

the appeal be dismissed.

The request for information had already been complied with in letters dated May 8, 2020 and July 21, 2021. Furthermore, Art. 15 GDPR does not give rise to any further right to full access to the files. The statements of the lower court are correct.

Reasons for the decision

II.

The appeal is inadmissible with regard to the claim for damages in the amount of €450, which was made for the first time in the appeal proceedings.

The application for damages represents an extension of the claim, which is inadmissible in the appeal proceedings because there is no decision by the Fiscal Court as the subject of the appeal court's review (cf. Section 123 Paragraph 1 Sentence 1 of the Fiscal Court Code (FGO); BFH judgments of November 26, 1998 - IV R 66/97, BFH/NV 1999, 788, under I. and of November 15, 2022 - VII R 29/21 (VII R 17/18), BFHE 279, 1, BStBl II 2023, 803, para. 41 ff.). Contrary to the plaintiff's view, the claim for damages is not included as a minus in the request for information. While the request under Article 15 GDPR is aimed at the provision of information, the request for damages is aimed at compensation for damage, i.e. an aliud. The latter leaves the right to information unaffected, notwithstanding the present restriction as a result of access to the files.

III.

In all other respects, the appeal is admissible and justified and, in accordance with Section 126 Paragraph 3 Sentence 1 No. 2 FGO, leads to the annulment of the tax court judgment and the referral of the matter back for another hearing and decision. The FG rightly decided that the plaintiff is entitled in principle to information about the personal data concerning him and processed by the tax office (see 1.). However, the FG erred in law in assuming that the tax office could object to the provision of information on the grounds that this would involve disproportionate effort (see 2.) and that the request for information was excessive (see 3.). The matter is not ready for judgment because the findings required for a final review as to whether the right to information has already been fulfilled and has therefore been lost (see 4.) are missing.

1. The plaintiff is entitled in principle to information from the tax office in accordance with Art. 15 GDPR.

a) The processing of the plaintiff's personal data by the tax office is subject to the provisions of the General Data Protection Regulation.

aa) As a European Union regulation, the General Data Protection Regulation applies directly in every Member State according to Art. 288 of the Treaty on the Functioning of the European Union (TFEU) without the need for implementation in national law.

bb) In substance, the General Data Protection Regulation applies according to Art. 2 Para. 1 GDPR to the fully or partially automated processing of personal data as well as to the non-automated processing of personal data that is or is to be stored in a filing system. According to Art. 4 No. 2 GDPR, the term processing refers to any operation or set of operations carried out with or without the aid of automated procedures in connection with personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of provision, comparison or linking, restriction, erasure or destruction. The data that is at least partially processed automatically also includes the plaintiff's personal data in the paper files of the tax office, as these are used to carry out the at least partially digitalized taxation procedure. Against this background, all of the plaintiff's personal data contained in emails, meeting minutes and other documents - as the FG also recognized in the result - also fall within the scope of the General Data Protection Regulation (see Senate judgment of March 12, 2024 - IX R 35/21, intended for official publication, BStBl II 2024, 682, para. 15 ff.).

cc) There is no restriction of the scope of the General Data Protection Regulation by the exceptions regulated in Art. 2 Para. 2 and Para. 3 GDPR. Since this is undisputed between the parties, the Senate refrains from providing further explanations.

b) The plaintiff as a data subject within the meaning of Art. 4 No. 1 GDPR has, according to Art. 15 Para. 1 Clause 1 GDPR, the right to information from the tax office as the controller within the meaning of Art. 4 No. 7 GDPR about the personal data concerning him processed by the tax office and about the information specified in Art. 15 Para. 1 Letters a to h GDPR.

c) In addition, the plaintiff is entitled in principle to receive a copy of the personal data that are the subject of the processing in accordance with Art. 15 Para. 3 Clause 1 GDPR.

aa) The provision generally does not grant an independent claim against the controller to provide documents containing personal data compared to Art. 15 Para. 1 GDPR. The case law of the ECJ has clarified that Art. 15 GDPR is not to be interpreted as granting a different right in its Paragraph 3 Clause 1 than that provided for in its Paragraph 1. Furthermore, the term "copy" does not refer to a document as such, but to the personal data it contains, which must be complete. The copy must therefore contain all the personal data that are the subject of the processing (ECJ judgments FT (Copies du dossier médical) of 26.10.2023 - C-307/22, EU:C:2023:811, para. 72; Austrian Data Protection Authority of 04.05.2023 - C-487/21, EU:C:2023:369, para. 32; Senate judgment of 12.03.2024 - IX R 35/21, intended for official publication, BStBl II 2024, 682, para. 27).

bb) Only if the provision of a copy is essential to enable the data subject to effectively exercise the rights conferred on him or her by the General Data Protection Regulation, taking into account the rights and freedoms of others in this respect, is there a right under Article 15(3) sentence 1 GDPR to receive a copy of extracts from documents or even entire documents or extracts from databases (cf. ECJ judgments FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811, para. 75; Austrian Data Protection Authority of May 4, 2023 - C-487/21, EU:C:2023:369, para. 41 and para. 45). However, this was not requested in the legal proceedings. Rather, the application binding on the courts is directed at the provision of a copy of the data. The Senate cannot go beyond this in the appeal proceedings.

d) As the FG correctly recognized, insufficient information as defined in Section 32c (2) of the Fiscal Code (AO) does not justify a rejection of the request for information within the meaning of Art. 15 GDPR.

According to this provision, the data subject must specify in detail the type of personal data about which information is to be provided in the request for information pursuant to Art. 15 GDPR. However, the regulation does not provide for a legal consequence, in particular a loss of the right to information or a right to refuse it. Against the background of Art. 23 (2) (c) GDPR, however, this would be necessary for the assumption of a corresponding legal consequence. According to this provision, any norm that, among other things, restricts the right to information under Art. 15 GDPR must at least regulate the scope of the restriction made.

2. However, the FG incorrectly comes to the conclusion that the right to information does not exist due to disproportionate effort.

a) Regardless of the fact that there is no evidence of disproportionate expenditure on the part of the tax authorities, a corresponding restriction of the right to information does not arise from the General Data Protection Regulation.

aa) According to Art. 14 Para. 5 Letter b Alternative 2 GDPR, the controller does not have to comply with its obligation under the General Data Protection Regulation if this would involve disproportionate expenditure. However, this only applies to the obligation to provide information within the meaning of Art. 14 GDPR.

An analogous application of Art. 14 para. 5 letter b alternative 2 GDPR to a request for information is also ruled out (judgment of the Federal Administrative Court of 30.11.2022 - 6 C 10.21, BVerwGE 177, 211, para. 36; Starke, Journal of Data Protection ‑‑ZD‑‑ 2024, 63, 66; Schreiber/Brinke, Law Digital 2023, 232, 235; Kuznik, New Journal of Administrative Law 2023, 297, 303; Korch/Chatard, ZD 2022, 482, 484; Waldkirch, law and damage ‑‑r+s‑‑ 2021, 317, 319; Schulte/Welge, New Journal of Labor law ‑‑NZA‑‑ 2019, 1110, 1114; cf. Benkert, Neue Juristische Wochenschrift Spezial 2022, 306, 307; Krämer/Burghoff, ZD 2022, 428, 431; Lembke/Fischels, NZA 2022, 513, 516; König, Computer und Recht ‑‑CR‑‑ 2019, 295, 298; a.A. BeckOK DatenschutzR/Schmidt-Wudy, 49th Ed. 01.08.2024, GDPR Art. 15 Rz 99.3; Härting, CR 2019, 219, 223). There is already a lack of an unplanned regulatory gap required for this. While Art. 14 GDPR regulates the obligation to provide information if the personal data were not collected from the data subject, Art. 15 GDPR contains the data subject's right to information about the processing of personal data concerning him or her.

In addition to these provisions, Art. 12 GDPR contains additional modalities, among other things, for the exercise of these rights. The objection of disproportionate effort is not regulated here. The right to information is not subject to the general reservation of proportionality with regard to the efforts that the controller must make to comply with the data subject's request (Guidelines of the European Data Protection Board 01/2022 on the rights of the data subject - right to information, version 2.1, p. 5).

In addition, there is no comparable situation of interests between the obligation to provide information under Art. 14 GDPR and the obligation to provide information under Art. 15 GDPR. While Art. 14 GDPR imposes an obligation on the controller to inform the data subject about the personal data collected, the right to information under Art. 15 GDPR only exists at the request of the data subject.

The right to information is also aimed in particular at obtaining knowledge about the personal data processed in each case, while Art. 14 GDPR does not impose an obligation to inform the data subject about which specific personal data has been collected about them. Thus, under Art. 14 Para. 1 Letter d GDPR, the obligation to provide information is limited to the categories of personal data.

bb) Nor does Art. 15 Para. 4 GDPR result in a corresponding restriction of the right to information if the provision of information would entail disproportionate effort (a.A. Starke, ZD 2024, 63, 66). According to Art. 15 Para. 4 GDPR, the right to receive a copy within the meaning of Art. 15 Para. 3 Sentence 1 GDPR must not affect the rights and freedoms of other persons. Art. 15 para. 4 GDPR restricts the right to information only with regard to the rights of third parties, but not with regard to the interests of the controller, in particular with regard to the effort involved in protecting the rights of third parties (cf. ECJ judgment FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811, paras. 63, 67; a.A. Kamlah in Plath, DSGVO/BDSG/TTDSG, 4th ed., Art. 15 DSGVO para. 20; Schwartmann/Klein/Peisker in Schwartmann/Jaspers/Thüsing/Kugelmann, DS-GVO/BDSG, 3rd ed., Art. 15 DSGVO para. 68).

cc) Nor can such an objection be derived from Recital 63, Sentence 7 of the GDPR. According to this, the controller should be able to demand that the data subject specify which information or processing operations their request for information relates to before providing information if they process a large amount of information about the data subject. However, no general legal principle can be derived from the recitals that leads to a restriction of the rights and obligations under the General Data Protection Regulation. It is in line with the case law of the ECJ that recitals are not legally binding and cannot be used either to deviate from the provisions of the legal act in question or to interpret these provisions in a way that is obviously contrary to their wording (cf. ECJ judgment Hauptzollamt Bremen v. J. E. Tyson Parketthandel GmbH hanse j. of 02.04.2009 - C-134/08, EU:C:2009:229, para. 16). This is the case here. The inclusion of Recital 63 Sentence 7 GDPR would result in the rights under Article 15 Paragraph 1 or Paragraph 3 GDPR being restricted without an express regulation, although such a regulation is required under Article 23 Paragraph 2 Letter c GDPR. The recitals do not replace these, as they are not legally binding according to the principles mentioned above.

b) A restriction of the right to information in the event of disproportionate effort for providing information does not arise from the provisions of national law.

According to Section 32c Paragraph 1 No. 3 AO, the objection of disproportionate effort is only to be taken into account if the personal data is only stored because it cannot be deleted due to statutory retention requirements (Section 32c Paragraph 1 No. 3 Letter a AO) or if the personal data is used exclusively for data backup or data protection control purposes (Section 32c Paragraph 1 No. 3 Letter b AO). It is also necessary that processing for other purposes is excluded by suitable technical and organizational measures (Section 32c Paragraph 1 No. 3 AO).

As the Senate has already decided, there is already no legal obligation for the tax authorities to retain data (Senate judgment of May 7, 2024 - IX R 21/22, intended for official publication, guideline No. 3 and Rz 33). Furthermore, it was neither stated nor established by the FG that the tax office processes the plaintiff's personal data exclusively for data backup or data protection control and that processing for other purposes is excluded by suitable technical and organizational measures. Ultimately, this is also unlikely, since the task of the tax authorities is to determine and collect taxes.

aa) To the extent that information pursuant to Section 32c Paragraph 3 AO is only provided if the data subject provides information that enables the data to be found and the effort required to provide the information is not disproportionate to the interest in information asserted by the data subject, this objection cannot be used to counter a request for information pursuant to Art. 15 GDPR. This is because Section 32c Paragraph 3 AO only applies if the personal data is neither stored automatically nor in non-automated file systems (BTDrucks 18/12611, p. 88). The restriction therefore lies outside the scope of the General Data Protection Regulation.

bb) The right to information cannot be opposed by the provision of Section 275 (2) of the German Civil Code (BGB) or the legal concept expressed therein that the debtor can refuse to perform a service if this requires an expenditure which, taking into account the content of the contractual relationship and the principles of good faith, is grossly disproportionate to the creditor's interest in performance (see also Starke, ZD 2024, 63, 66; König, CR 2019, 295, 298; cf. Waldkirch, r+s 2021, 317, 319; a.A. Gola/Heckmann/Franck, DS-GVO, 3rd ed., Art. 15 Rz 51).

3. The FG also came to the conclusion, which was legally incorrect, that the request for information was excluded due to an excessive request within the meaning of Art. 12 Para. 5 Sentence 2 and 3 GDPR.

a) According to Art. 12 Para. 5 Sentence 2 GDPR, in the case of manifestly unfounded or excessive requests from a data subject, particularly in the case of frequent repetition, the controller can either demand a reasonable fee that takes into account the administrative costs of informing or communicating or implementing the requested measure (Art. 12 Para. 5 Sentence 2 Letter a GDPR), or refuse to act on the request (Art. 12 Para. 5 Sentence 2 Letter b GDPR). According to Art. 12 Para. 5 Sentence 3 GDPR, the controller must provide evidence of the manifestly unfounded or excessive nature of the request. According to the case law of the ECJ, the two reasons why the controller does not have to comply with the data subject's request under Article 12 (5) sentence 2 GDPR relate to cases of abuse of rights (ECJ judgment FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811, paragraph 31). If the request is excessive, it cannot at the same time be seen as a lesser permissible request for the provision of copies of personal data. This is clear from Article 12 (5) sentence 2 letter b GDPR. If the controller does not demand a reasonable fee, he does not need to take action if the request is refused due to an excessive request (see Senate judgment of March 12, 2024 - IX R 35/21, intended for official publication, BStBl II 2024, 682, para. 32). Furthermore, no justification is required to assert the claim under Art. 15 (3) sentence 1 GDPR to provide copies of personal data (ECJ judgment FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811, para. 38).

b) The FG's statements on Art. 12 (5) sentences 2 and 3 GDPR do not meet these standards.

The FG erroneously assumes an exception to the tax office's obligation to provide evidence for accepting an excessive application, since the circumstances leading to the application being unfounded should already be apparent from the application and are therefore obvious. Otherwise, the obligation to provide evidence under Art. 12 Para. 5 Sentence 3 GDPR would be ineffective. The FG fails to recognize that the right to refuse under Art. 12 Para. 5 Sentence 2 Letter b GDPR only exists if the application is manifestly unfounded or excessive. Although the FG uses the term "obvious", this means the same as "obvious".

Furthermore, a request for information cannot be considered excessive if the data subject requests information about their personal data without (largely) restricting this request in terms of content or time, as is the case here. According to Art. 15 Para. 1 GDPR, there is a right to information about all personal data that the controller processes. This is the only way to adequately take into account the purpose of Article 15 of the GDPR, which is to enable the data subject to be aware of the processing of personal data concerning him or her and to be able to check its legality at appropriate intervals by exercising the right to information (see Recital 63, Sentence 1 of the GDPR). This would be contradicted if the controller could refuse to provide information if the data subject asserts his or her right to information without restriction.

Furthermore, an excessive application cannot be justified by the fact that the tax office offered the plaintiff the opportunity to inspect the files. The opportunity to inspect the files proves to be an aliud compared to the request for a copy of the personal data to be made available. While the right to inspect the files includes the temporary possibility of inspecting the entire administrative file, Article 15 of the GDPR does not concern the entire administrative file, but is aimed at the permanent transfer of the personal data contained therein and only exceptionally under certain circumstances at the transfer of extracts from administrative files. In addition, the right to inspect files concerns an insight into the original file, while Art. 15 GDPR is aimed at providing information and making copies available.

Nor can it be relevant for the assumption of excess that, in the opinion of the FG, the plaintiff is pursuing purposes other than those served by the General Data Protection Regulation with his request for information. To the extent that the data subject is free to request information under Art. 15 GDPR even without giving reasons for their request, an excessive request cannot be assumed on the grounds that the data subject is pursuing purposes other than those of the General Data Protection Regulation with their request for information (see ECJ judgment FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811, para. 51 et seq.). Rather, it would be contradictory if a right of refusal arose because the person concerned did not specify in more detail the type of personal data about which information was requested.

Furthermore, an excessive request cannot be assumed simply because the plaintiff did not specify in more detail the type of personal data about which information was to be provided in his request for information. Insofar as Section 32c Paragraph 2 of the Fiscal Code contains a corresponding requirement, this is a mere provision to which no legal consequence is attached.

4. The matter is not ready for judgment and should therefore be referred back to the Fiscal Court.

a) There is already a lack of a finding of abusive conduct or of findings regarding the tax office's arguments in this regard against the background of the burden of proof incumbent upon it of an obviously unfounded or excessive application (see Senate judgment of 12 March 2024 - IX R 35/21, intended for official publication, BStBl II 2024, 682, para. 31).

b) Based on its legal opinion that there is no claim under Art. 15 (1) and (3) GDPR, the FG did not examine whether the right to information, which in principle exists according to the principles mentioned above, has already expired due to fulfillment.

aa) A right to information is generally fulfilled if the information provided by the person obliged to provide information represents the information in the full scope owed according to his or her declared will. Essential for the fulfillment of the right to information is the - possibly implied - declaration by the person obliged to provide information that the information is complete (see judgments of the Federal Court of Justice - BGH - of September 3, 2020 - III ZR 136/18, para. 43, with further references and of June 15, 2021 - VI ZR 576/19, para. 19). The assumption of such a declaration content presupposes that the information provided is clearly intended to completely cover the subject matter of the legitimate request for information. This is not the case, for example, if the person obliged to provide information has not made a statement with regard to a certain category of information items, for example because he mistakenly assumes that he is not obliged to provide information with regard to these items. The person entitled to information can then request that the information be supplemented (BGH ruling of June 15, 2021 - VI ZR 576/19, para. 20, with further references).

If the person obliged to provide information has declared - at least implicitly - that he has provided the information completely and correctly, the request for information is deemed to have been fulfilled, provided that the FG has no doubts about the correctness of the declaration of completeness. The Senate assumes such doubts - comparable to the civil law regulations on affidavits with regard to the duty to provide accountability and information under Section 259 Paragraph 2 and Section 260 Paragraph 2 of the German Civil Code - if there is reason to believe that the information was not provided with the necessary care. In this case, the declaration of completeness does not lead to the expiration of the request for information and the person entitled to information can demand that the person obliged to provide information provide complete and accurate information while observing the necessary care.

bb) Applying these standards, there is a lack of determination as to the extent to which the plaintiff's request for information has already been fulfilled. The FG will have to make this up in the second legal process.

(1) To the extent that the tax office argues that it has already complied with the request for information in letters dated May 8, 2020 and July 21, 2021, the tax court will have to examine in particular to what extent these letters provided the plaintiff with information regarding the personal data concerning him that was processed by the tax office and to what extent these letters at least imply that the information provided was complete. In particular with regard to the letter dated May 8, 2020, the Senate has doubts about this - without binding effect for the tax court - because the plaintiff only subsequently submitted his own request for information in accordance with Art. 15 GDPR in a letter dated November 25, 2020. The same applies to the letter dated July 21, 2021 issued in the context of the first instance proceedings, insofar as the information regarding the Z-atypically silent was thus provided. In addition, the tax office has the option in the second instance to obtain the information if necessary and to declare that the information provided is complete.

(2) In addition, the Senate points out that the right to information was not fulfilled by granting access to the files on September 1, 2022. The form of the information is at the discretion of the tax office in accordance with Art. 15 GDPR in accordance with Section 32d (1) AO. However, this only applies if Art. 12 to 15 GDPR do not contain any relevant provisions. For example, Article 15 (3) GDPR stipulates that the information pursuant to Article 15 GDPR must be provided by making a copy available (see ECJ rulings FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811, para. 72; Austrian Data Protection Authority of May 4, 2023 - C-487/21, EU:C:2023:369, para. 32). Granting access to the files is not the same as this. Rather, this is an aliud (see III.3.b).

(3) If the FG comes to the conclusion that the tax office has at least implicitly declared that it has fulfilled the plaintiff's request for information, it will have to determine to what extent there could be reason to believe that the information was not provided with the necessary care. The FG will have to take into account that this is not the case if the person concerned makes a blanket statement "out of the blue" that the information is incomplete. Otherwise, the person entitled to information could also undermine the fundamental fulfillment effect of the declaration of completeness for irrelevant reasons. Instead, the person entitled to information must present substantiated reasons that lead to the assumption that the information provided is incomplete.

(4) If the FG comes to the conclusion that the tax office has not yet declared - at least implicitly - by the end of the oral hearing that it has fully fulfilled the plaintiff's request for information or that there is reason to believe that the information was not provided with the necessary care, it will oblige the tax office to provide the requested information.

5. There is no need for a referral to the ECJ under Article 267(3) TFEU in the present proceedings. For the reasons stated in each case, the legal situation is clear ("acte clair", decisions of the Federal Constitutional Court - BVerfG - of 19 July 2011 - 1 BvR 1916/09, BVerfGE 129, 78, under C.I.2.e and of 4 March 2021 - 2 BvR 1161/19, para. 55; ECJ judgment Srl CILFIT and Lanificio di Gavardo SpA v Ministero della Sanità of 6 October 1982 - C-283/81, EU:C:1982:335, para. 16) or has already been clarified by the ECJ's case law in a way that leaves no reasonable doubt ("acte éclairé", BVerfG decision of 04.03.2021 - 2 BvR 1161/19, para. 55; ECJ judgment Srl CILFIT and Lanificio di Gavardo SpA v Ministero della Sanità of 06.10.1982 - C-283/81, EU:C:1982:335, para. 14). In particular, in view of the clear wording of Art. 14 para. 5 letter b alternative 2 GDPR and Art. 15 paras. 3 and 4 GDPR, the deciding Senate has no doubt that the request for information pursuant to Art. 15 paras. 1 and 3 GDPR cannot be countered with the objection of disproportionate effort associated with providing the information. Even if a corresponding statement can be found in Recital 63, Sentence 7 of the GDPR, the Senate hearing the case has no doubt, against the background of the ECJ judgment Hauptzollamt Bremen v. J. E. Tyson Parketthandel GmbH hanse j. of 02.04.2009 - C-134/08, EU:C:2009:229, that no general legal principle valid for the application of Art. 15 of the GDPR can be derived from this. The case law of the ECJ has also clarified that the reasons for refusing a request for information under Article 12 paragraph 5 sentence 2 letter b GDPR require an abusive conduct (ECJ judgment FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811) and that the request for information about the personal data processed does not require any justification (ECJ judgment FT (Copies du dossier médical) of October 26, 2023 - C-307/22, EU:C:2023:811, paragraph 38).

6. Since the appeal, insofar as it is admissible, is already successful on substantive grounds, it can remain open to what extent the procedural errors complained of exist.

7. The decision on costs is based on Section 143 paragraph 2 of the FGO.
Retrieved from "https://gdprhub.eu/index.php?title=BFH_-_IX_R_25/22&oldid=46374"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki