BGH - I ZR 115/25
From GDPRhub
| BGH - I ZR 115/25 | |
|---|---|
 | |
| Court: | BGH (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 12(5) GDPR Article 15 GDPR Article 15(1) GDPR Article 15(3) GDPR |
| Decided: | 18.12.2025 |
| Published: | |
| Parties: | |
| National Case Number/Name: | I ZR 115/25 |
| European Case Law Identifier: | ECLI:DE:BGH:2025:181225UIZR115.25.0 |
| Appeal from: | OLG Dresden (Germany) |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | openjur (in German) |
| Initial Contributor: | lde |
A court held that information relating to the premium history of a private health insurance contract does not automatically constitute personal data under Article 15 GDPR. Such information only qualifies as personal data where it is linked to an identified or identifiable natural person.
English Summary
Facts
The data subject had private health and long-term care insurance with the controller since 2010. Over the years, the controller adjusted the monthly insurance premiums several times, and informed the data subject of these adjustments through policy supplements and standardised explanatory letters, which the data subject no longer possessed.
In March 2023, the data subject requested that the controller provide copies of the documents relating to past premium adjustments. After the controller refused, the data subject brought an action seeking access under Article 15(1) and (3) GDPR. Specifically, the data subject requested information concerning the contribution history of the insurance contract, including the dates and amounts of old and new premiums, tariff changes, and tariff terminations for several years.
The court of first instance dismissed the claim. On appeal, the appellate court partially upheld the data subject’s request, holding that the requested information constituted personal data and therefore fell within the scope of Article 15 GDPR. The controller appealed to the Federal Court of Justice.
The controller argued that the requested information did not constitute personal data because premium adjustments and tariff information were determined on an abstract, tariff-based basis and were not linked to the individual data subject. It further argued that the data subject’s request constituted an abuse of rights, as it was intended to prepare a repayment claim rather than to exercise data protection rights.
Holding
The Court upheld the appeal, set aside the appellate judgment, and referred the case back for a new decision.
The Court confirmed that Article 15 GDPR applies irrespective of the data subject’s motivation and that a request for access cannot be refused merely because it serves purposes unrelated to data protection. It also rejected the controller’s argument that the request constituted an abuse of rights under Article 12(5) GDPR.
However, the Court held that the appellate court had made a mistake in assuming that all of the requested information constituted personal data, as information qualifies as personal data only if it relates to an identified or identifiable natural person. The mere fact that information has an economic impact on a person is not sufficient to render it personal data.
The Court clarified that premium adjustments, tariff changes, and tariff terminations in private health insurance are generally based on abstract calculations applicable to groups of policyholders and do not, as such, allow identification of an individual data subject. Accordingly, information on the dates and amounts of premium adjustments and tariff changes does not automatically constitute personal data within the meaning of Article 4(1) GDPR.
However, the Court reiterated that correspondence originating from the data subject constitutes personal data in its entirety, while correspondence from the controller only constitutes personal data insofar as it contains information relating to the data subject. As the appellate court had applied an incorrect legal standard when assessing whether the requested contribution history information constituted personal data, the case was referred back for reconsideration.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Information on the contribution history of a private health insurance contract (namely, the date and amount of the old and new contributions for each contribution adjustment, the date of any tariff changes, including the original and target tariffs, and the date of any tariff terminations) constitutes personal data within the meaning of Article 15(1) in conjunction with Article 4(1) GDPR only if it is linked to a specific person, i.e., if the person is identified or can be identified (directly or indirectly) on the basis of the information (see ECJ, Judgment of 19 October 2016 - C-582/14, NJW 2016, 3579 [juris paras. 47 to 49] - Breyer; Judgment of 7 March 2024 - C-604/22, EuGRZ 2024, 111 [juris paras. 37 to 39] - IAB Europe/Gegevensbeschermingsautoriteit). The fact that information relates to a matter that affects a specific person is not sufficient on its own to classify it as personal data.
Judgment
The appeal of the defendant is granted, and the judgment of the 3rd Civil Chamber of the Leipzig Regional Court of April 17, 2025, is set aside.
The case is remanded to the court of appeals for a new hearing and decision, including on the costs of the appeal.
By law
Facts
The plaintiff has been privately insured with the defendant for health and long-term care since September 2010. In recent years, the monthly premium he pays has been adjusted several times. The plaintiff was notified of each adjustment by receiving a supplementary insurance policy and a standardized information letter regarding the premium adjustment. The plaintiff no longer has the supplementary insurance policies or the letters of explanation. In March 2023, he unsuccessfully requested the defendant to release these documents.
The local court dismissed the plaintiff's claim for disclosure of information and damages. The plaintiff appealed this decision. In the appeal proceedings, he partially amended his claims and added a subsidiary claim. In this ancillary claim, based on Article 15(1) and (3) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR), the plaintiff seeks:
an order requiring the defendant to provide the plaintiff with a copy of the personal data relating to the premium history of the insurance contract with the policy number – excluding the long-term care insurance tariff – for the years 2014, 2015, 2017, 2018, 2019, 2020, 2021, and 2023, containing the following information:
a) the date and amount of the old and new premiums for each premium adjustment pursuant to Section 203(2) of the German Insurance Contract Act (VVG),
b) the date of any tariff changes, specifying the original and new tariffs,
c) the date of any tariff terminations.
... The Court of Appeals amended the judgment of the Local Court and, while dismissing the appeal in all other respects, ordered the defendant to comply with the alternative claim. With its appeal on points of law, which was granted by the Court of Appeals and whose dismissal the plaintiff requests, the defendant continues to pursue its claim for complete dismissal of the action.
Reasons
A. The Court of Appeals held that the plaintiff had a right of access pursuant to Article 15(1) and (3) GDPR because the information requested in the alternative claim constituted personal data. It reasoned as follows:
The term "personal data" is to be interpreted broadly. At least with regard to the requested information concerning policy terminations and changes, it must be noted that this information depends on the policyholder's contractual declarations. However, letters from the policyholder to the insurance company generally constitute personal data in their entirety. Furthermore, policy changes and terminations occur individually and not uniformly within a single unit of observation, so that the identification of the data subjects based on this data does not appear to be precluded. The composition of the tariffs for individual policyholders can vary, just as the premium amount can vary depending on risk surcharges, for example, due to pre-existing conditions.
The same applies to the requested information about the timing and amount of premium adjustments. Even if the timing and amount of premium changes are not decided individually, but rather based on abstract parameters within an observation unit, they nevertheless have a direct impact—once made—once they occur, on the individually owed insurance premium and thus on the individual insurance relationship. They are therefore not comparable to the triggering factors for which the Federal Court of Justice denied the status of personal data. Unlike those, premium adjustments directly affect the policyholder.
The defendant cannot object to the request for information by arguing that the plaintiff is pursuing purposes unrelated to data protection, namely obtaining information to prepare for a recovery action, since Article 15 GDPR does not make the existence of the rights and obligations regulated therein dependent on a specific motivation.
B. The defendant's appeal is successful. It leads to the reversal of the judgment of the court of appeals and the remand of the case to that court. Although the claim is not precluded by the objection of abuse of rights (see section B IV), the Court of Appeal's reasoning precludes granting the plaintiff the asserted right to information under Article 15(1) and (3) GDPR (see section B V).
I. Article 15 GDPR is applicable in terms of timing. The General Data Protection Regulation (GDPR) also applies to processing operations carried out before May 25, 2018, the date from which the Regulation applies pursuant to Article 99(2), if the request for access—as in the present case—was submitted after that date (see CJEU, Judgment of June 22, 2023 – C-579/21, NJW 2023, 2555 [juris para. 36] – Pankki S; German Federal Court of Justice (BGH), Judgment of April 16, 2024 – VI ZR 223/21, WM 2024, 991 [juris para. 10]).
II. Pursuant to Article 15(1) GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed; If this is the case, the data subject has the right to access this personal data and the information listed below in the regulation. According to Article 15(3), first sentence, of the GDPR, the controller shall provide a copy of the personal data undergoing processing.
According to Article 4(1), first sentence, of the GDPR, the term "personal data" means any information relating to an identified or identifiable natural person ("data subject"). According to Article 4(1), second sentence, of the GDPR, an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name or an identification number, which expresses the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
According to Article 4(7), first sentence, of the GDPR, the "controller" is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
III. The Court of Appeal correctly concluded that the personal scope of Article 15(1) and (3) of the GDPR applies because the plaintiff is a "data subject" and the defendant is a "controller" within the meaning of Article 4(1) and (7) of the GDPR.
IV. The appeal is unsuccessful in arguing that any potential right of access by the plaintiff under Article 15 of the GDPR is precluded by Article 12(5), second sentence, point (b) of the GDPR because invoking the right of access constitutes an abuse of rights.
1. Pursuant to Article 12(5), second sentence, point (b) of the GDPR, the controller may refuse to act on a data subject's request if it is manifestly unfounded or excessive, particularly in cases of frequent repetition. Based on the findings of the Court of Appeal, there is no indication that the plaintiff's request for access is manifestly unfounded or excessive. The appellant also does not claim that these conditions are met in the present case.
2. As the appellant also acknowledges, according to established case law, the provision of an initial copy of personal data free of charge is not contingent upon the data subject providing grounds for their request (see CJEU, Judgment of 26 October 2023 – C-307/22, NJW 2023, 3481 [juris para. 38] – FT [Copies of medical records]). The exercise of the right of access under Article 15(1) GDPR may not be made subject to conditions not expressly stipulated by the Union legislator, such as the obligation to invoke one of the grounds mentioned in the first sentence of Recital 63 of the General Data Protection Regulation (namely, to be aware of the processing and to be able to verify its lawfulness) (see CJEU, NJW 2023, 3481 [juris para. 51] - FT [Copies of medical records]; BGH, Judgment of 5 March 2024 - VI ZR 330/21, WM 2024, 733 [juris para. 20]). The Court of Appeals therefore correctly recognized that the plaintiff's right to information is not precluded by the fact that he seeks to obtain information in preparation for a potential recovery action against the defendant (see Higher Regional Court of Koblenz, NJW-RR 2023, 1592 [juris para. 61]; Higher Regional Court of Dresden, NJW-RR 2025, 609 [juris para. 50]).
3. Contrary to the appellant's argument, the Court of Appeals also did not disregard any submissions by the defendant that were material to the decision regarding an abuse of rights in asserting the right to information, in violation of Section 286 of the German Code of Civil Procedure.
a) It is unnecessary to decide whether the appellant correctly assumes that the controller's right to refuse to provide the requested information exists not only under the circumstances specified in Article 12(5), second sentence, GDPR, but also in cases of abuse of rights (as apparently held by the Higher Regional Court of Düsseldorf, ZD 2025, 224 [juris para. 164]). The appellant's submissions are insufficient to demonstrate such a violation.
b) Insofar as the appellant argues that the abuse of rights inherent in a request for information can arise not only from the pursuit of purposes unrelated to data protection, but also from other circumstances, it fails to specify which other circumstances are alleged to exist in the present case. The Court of Appeal expressly addressed the defendant's argument, which was the sole point raised in this context, that the plaintiff had no legitimate interest in the requested information. The Court of Appeal correctly stated that the existence of the rights and obligations regulated in Article 15 of the GDPR is not contingent upon a motivation that corresponds to the protective purpose of verifying the lawfulness of the processing of the stored data.
c) Insofar as the appellant further argues that the Court of Appeal failed to consider that the defendant expressly denied in the appeal proceedings that the requested documents were no longer in the plaintiff's possession, this argument cannot overturn the Court of Appeal's finding to the contrary. The procedural objection based on this is inadmissible according to the established case law of the Federal Court of Justice (BGH) because the appellate court's finding was not challenged by a motion to correct the statement of facts pursuant to Section 320 of the German Code of Civil Procedure (ZPO) (see, e.g., BGH, Decision of July 1, 2021 - V ZB 55/20, NJW-RR 2021, 1598 [juris para. 11] with further references; Decision of February 10, 2022 - I ZB 46/21, NJOZ 2022, 1110 [juris para. 13]; Decision of March 21, 2025 - V ZR 1/24, NJW-RR 2025, 586 [juris para. 13] with further references).
... V. The Court of Appeal's reasoning does not support the conclusion that all the information requested by the plaintiff constitutes personal data within the meaning of Article 15(1) and (3) and Article 4(1) GDPR.
1. The Court of Appeal correctly began by stating that the term "personal data" is to be interpreted broadly and does not include only sensitive or private information. Rather, the term potentially encompasses all types of information, both objective and subjective, provided that it relates to the individual in question. The latter requirement is met if the information, due to its content, purpose, or effects, is linked to a specific person (see CJEU, Judgment of 20 December 2017 - C-434/16, NJW 2018, 767 [juris para. 34 et seq.] - Nowak; Judgment of 4 May 2023 - C-487/21, NJW 2023, 2253 [juris para. 23 et seq.] - Austrian Data Protection Authority and CRIF; German Federal Court of Justice, Judgment of 22 February 2022 - VI ZR 14/21, NJW-RR 2022, 764 [juris para. 11]; Judgment of 27 September 2023 - IV ZR 177/22, NJW 2023, 3490 [juris para. 47]; Judgment of February 6, 2024 - VI ZR 15/23, WM 2024, 555 [juris para. 7], with further references).
2. Letters from the data subject to the controller are to be classified as personal data in their entirety, since the personal information already consists of the fact that the data subject has expressed themselves in the letter. However, this does not apply to letters from the controller to the data subject, such as those at issue in the present case. These documents are subject to the right of access under data protection law only insofar as they contain information about the data subject according to the criteria outlined above (see Federal Court of Justice [BGH], Judgment of June 15, 2021 - VI ZR 576/19, NJW 2021, 2726 [juris para. 25]; BGH, NJW 2023, 3490 [juris para. 48]; BGH, Judgment of February 6, 2024 - VI ZR 62/23, ZD 2024, 346 [juris para. 10]).
3. According to the case law of the Federal Court of Justice, the explanatory letters and attachments issued by a private health insurance company regarding premium adjustments do not, in their entirety, constitute personal data of the policyholder. However, they may contain individual personal data of the policyholder (see BGH, NJW 2023, 3490 [juris para. 49]; BGH, Judgment of May 8, 2024 - IV ZR 102/23, RuS 2024, 633 [juris para. 10]; BGH, WM 2024, 555 [juris para. 8]). The triggering factor for a premium adjustment is not linked to a specific person. It is the deviation of the required insurance benefits or mortality probabilities from the calculated benefits in a tariff at a specified minimum level (Section 203 para. 2 of the German Insurance Contract Act (VVG) in conjunction with Section 155 paras. 3 and 4 of the German Insurance Supervision Act (VAG)); there is no connection to a specific policyholder (see BGH, RuS 2024, 633 [juris para. 14]).
... 4. Based on these standards, the Court of Appeal's reasoning does not support the conclusion that the information requested by the plaintiff regarding the date and amount of the old and new premiums for each premium adjustment, the date of tariff terminations and tariff changes (including the original and target tariffs), and the date of tariff terminations all constitute personal data within the meaning of Article 15(1) and (3) and Article 4(1) of the GDPR.
a) The higher courts are divided on whether information such as that which is the subject of the disputed request for information constitutes personal data.
(aa) According to one view, which the Court of Appeal adopted, the information requested by the plaintiff constitutes personal data (see Higher Regional Court of Rostock, ZD 2024, 728 [juris para. 157]; Higher Regional Court of Brandenburg, judgment of February 28, 2024 - 11 U 161/23, juris para. 12; judgment of May 3, 2024 - 11 U 19/24, juris para. 37; Higher Regional Court of Frankfurt, judgment of December 10, 2024 - 18 U 63/23, juris paras. 47 et seq.; Higher Regional Court of Karlsruhe, judgment of December 17, 2024 - 12 U 183/23, juris paras. 48 et seq.; Higher Regional Court of Jena, MDR 2025, 457 [juris paras. 68 to 70]; Higher Regional Court of Dresden, NJW-RR 2025, 609 [juris para. 39 to 42]).
(1) The reasoning is that the insurance policies and their amendments reveal the content and conditions of the insurance coverage provided to the policyholder by the insurer (cf. OLG Rostock, ZD 2024, 728 [juris para. 157]). The specified and individualized premium adjustment is a date that is directly tailored to the individual policyholder or affects only him/her (see Higher Regional Court of Brandenburg, judgment of February 28, 2024 - 11 U 161/23, juris para. 12; judgment of May 3, 2024 - 11 U 19/24, juris para. 37; Higher Regional Court of Karlsruhe, judgment of December 17, 2024 - 12 U 183/23, juris para. 49; Higher Regional Court of Jena, MDR 2025, 457 [juris para. 70]). It is sometimes emphasized that even if a premium or premium increase in a particular tariff or at a particular time has nothing to do with the insured per se, it is nevertheless linked to them and has an impact on them because they are insured under the corresponding tariffs and are thus directly affected by the increases and must pay the new premiums (see Frankfurt Higher Regional Court, judgment of December 10, 2024 - 18 U 63/23, juris para. 47).
``` (2) The same view is held regarding information about the timing and amount of tariff changes and terminations (see Higher Regional Court of Frankfurt, judgment of December 10, 2024 - 18 U 63/23, juris para. 49; Higher Regional Court of Karlsruhe, judgment of December 17, 2024 - 12 U 183/23, juris para. 50; Higher Regional Court of Jena, MDR 2025, 457 [juris para. 69]; contra Higher Regional Court of Dresden, NJW-RR 2025, 609 [juris para. 43]). This information depends on the policyholder's personal contractual declarations, in which the policyholder communicates to the insurer regarding the consequences of the tariff change or termination. According to the case law of the Federal Court of Justice, letters from the policyholder to the insurer generally constitute personal data in their entirety. Tariff changes and terminations occur individually and not uniformly within a single observation unit, so that identifying the affected person based on this data does not appear to be out of the question. This distinguishes it from the triggering factors, for which the Federal Court of Justice has denied the status of personal data. A change in the triggering factors does not necessarily have to affect the policyholder, as it does not always lead to a premium adjustment (cf. Higher Regional Court of Jena, MDR 2025, 457 [juris para. 69 f.]).
...] bb) According to the opposing view, information on contribution history, such as that which the plaintiff seeks to disclose, is not personal data (regarding the information sought in the present case, see Higher Regional Court of Dresden, decision of November 14, 2024 - 4 U 379/24, juris paras. 8 to 10; judgment of February 4, 2025 - 4 U 1627/22, juris paras. 29 to 31; decision of March 18, 2025 - 4 U 1586/22, juris paras. 40 to 42; Higher Regional Court of Dresden, decision of July 16, 2025 - 4 U 1448/22, juris paras. 40 to 44; regarding information on contribution adjustments, see Higher Regional Court of Schleswig, MDR 2022, 1286 [juris paras. 41 to 49]; Higher Regional Court of Koblenz, NJW-RR 2023, 1592 [juris paras. 52 to 54]; Cologne Higher Regional Court, Judgment of July 19, 2024 - 20 U 27/23, juris paras. 28 to 35; Judgment of January 28, 2025 - 3 U 71/24, juris paras. 3 to 17; Judgment of June 13, 2025 - 20 U 176/24, juris paras. 14 to 24; regarding information on tariff premiums, see Munich Higher Regional Court, RuS 2022, 94 [juris paras. 50 to 56]).
The information on the premium history is not linked to the policyholder. The increase is merely the result of a price calculation performed by the insurer for a specific tariff, taking into account defined parameters, and does not allow any conclusions to be drawn about the policyholder or their individual insurance contract. Rather, the calculation is performed in the same way for all policyholders who are grouped into an observation unit based on certain abstract parameters. The amount of a premium adjustment does not reflect the individualized insurance coverage of the policyholder, but only indicates the monthly difference in the price of the coverage provided by the insurance contract or the relevant tariff for a given policyholder, relative to the observation unit. The information regarding the premium payable for a specific tariff does not allow for the identification of the individual policyholder. For these reasons, the dates on which premium adjustments took effect did not constitute personal data about the policyholder, but merely information about the price of the respective insurance tariff affected by the adjustment, which had changed from a specific date (see Cologne Higher Regional Court, judgment of July 19, 2024 - 20 U 27/23, juris para. 33 et seq.; judgment of January 28, 2025 - 3 U 71/24, juris para. 10 et seq.; judgment of June 13, 2025 - 20 U 176/24, juris para. 20 to 23; Dresden Higher Regional Court, decision of November 14, 2024 - 4 U 379/24, juris para. 10; judgment of February 4, 2025 - 4 U 1627/22, juris para. 29 et seq.; decision of March 18, 2025 - 4 U 1586/22, juris Rn. 40 to 42; OLG Dresden, decision of July 16, 2025 - 4 U 1448/22, juris Rn. 41).
b) The latter view is correct, based on the respective findings, whereas the former view, which the Court of Appeal adopted, is based on an incorrect legal standard.
aa) As explained, for information to constitute personal data under the definition in Article 4(1) GDPR, it must relate to an identified or identifiable natural person, whereby indirect identifiability is sufficient. It must be information "about" a person, which is the case if the information is linked to a specific person due to its content, purpose, or effects (see paragraph 22 above and the references cited therein). The fact that information concerns a matter that has an impact on a specific person is therefore not sufficient on its own to establish that it constitutes personal data. Rather, the information must be linked to a specific person by virtue of such an effect (or its content or purpose) in the sense that the person is identified or can be identified (directly or indirectly) on the basis of the information (see CJEU, Judgment of 24 November 2011 - C-70/10, ECR 2022, I-11959 = ZUM 2012, 29 [juris para. 51] - Scarlet Extended; Judgment of 11 November 2014 - C-212/13, NJW 2015, 463 [juris para. 22] - Ryneš; Judgment of 19 October 2016 - C-582/14, NJW 2016, 3579 [juris paras. 47 to 49] - Breyer; Judgment of 7 March 2024 - C-604/22, EuGRZ 2024, 111 [juris paras. 37 to 39] - IAB Europe/Gegevensbeschermingsautoriteit).
bb) The Court of Appeal failed to consider this, relying primarily on the fact that the premium adjustments made by the defendant had a direct impact on the individually owed insurance premium and thus on the individual insurance relationship, following the reasoning of the Higher Regional Court of Thuringia (MDR 2025, 457 [juris para. 70]) and in accordance with the higher court case law presented in paras. 27 to 29. However, the Court of Appeal did not find that the person of the policyholder would be identified or identifiable based on the information about the timing and amount of premium adjustments or based on the determined effects on the insurance relationship (expressly denying this despite the assumption of personal data, Higher Regional Court of Brandenburg, judgment of May 3, 2024 - 11 U 19/24, juris para. 37). A connection between (initially) "neutral" data and a specific person (cf. BGH, NJW-RR 2022, 764 [juris para. 11]) is not established solely by the fact that the person in question is insured under the relevant tariffs and is specifically affected by the increases (correctly held by OLG Cologne, judgment of June 13, 2025 - 20 U 176/24, juris para. 22; contra OLG Frankfurt, judgment of December 10, 2024 - 18 U 63/23, juris para. 47; OLG Karlsruhe, judgment of December 17, 2024 - 12 U 183/23, juris para. 49).
The view presented above (under paragraphs 30 et seq.) rightly denies the connection to a specific person if the information on the contribution payable for a particular tariff does not allow any conclusions to be drawn about the policyholder, and the amount of the tariffs and the timing of a tariff increase or change merely provide information about the price to be paid for the provision realized by the insurance contract (cf. Higher Regional Court of Dresden, decision of March 18, 2025 - 4 U 1586/22, juris para. 40; Higher Regional Court of Cologne, judgment of January 28, 2025 - 3 U 71/24, juris para. 10; judgment of June 13, 2025 - 20 U 176/24, juris paras. 20 to 22). Contrary to the respondent's assertion, the Court of Appeal did not make any findings to the effect that the information sought in this case could reveal when a specific individual was insured under which tariff or when and how much insurance premiums they paid.
cc) The Court of Appeal's reasoning also fails to establish that the information sought by the plaintiff regarding the timing of tariff changes, including the originating and target tariffs, and the timing of tariff terminations constitutes personal data.
(1) To the extent that the Court of Appeal, in support of its assessment, refers to the fact that tariff changes and terminations depend on contractual declarations by the policyholder (see also Jena Higher Regional Court, MDR 2025, 457 [juris para. 69]), this argument is insufficient. While letters from the data subject to the controller are, according to the case law of the Federal Court of Justice cited above (paragraph 23), to be classified as personal data in their entirety because the personal information already consists of the fact that the data subject has responded to the letter, this alone does not imply that information about the (legal or factual) consequences arising from such letters (here: the tariff change based on a declaration by the insured) is itself personal data. Rather, any tariff changes represent a reaction originating from the insurance company to the policyholder's declarations. According to the case law cited above (paragraph 23), letters from the controller to the data subject are subject to the data protection right of access only insofar as they contain information about the data subject according to the relevant criteria.
However, this does not automatically mean that information about the (legal or factual) consequences of such letters (here: the tariff change based on a declaration by the insured) is itself personal data. (2) Contrary to the opinion of the Court of Appeal (see also Jena Higher Regional Court, MDR 2025, 457 [juris para. 69]), the fact that information on tariff changes and terminations is processed individually and not uniformly within a monitoring unit does not automatically imply that it constitutes personal data. The conclusion drawn from this circumstance, that the identification of the data subject based on this data "does not appear to be excluded," remains unclear and is not further substantiated by the Court of Appeal. Therefore, it is also insufficient in itself to establish that the requested data is personal data.
C. There is no reason to refer the matter to the Court of Justice of the European Union pursuant to Article 267(3) TFEU. There is no decisive question concerning the interpretation of EU law that has not already been clarified by the case law of the Court of Justice or cannot be answered beyond doubt (see ECJ, Judgment of 6 October 1982 - 283/81, ECR 1982, 3415 = NJW 1983, 1257 [juris para. 21] - Cilfit et al.; Judgment of 1 October 2015 - C-452/14, GRUR Int. 2015, 1152 [juris para. 43] - Doc Generici; Judgment of 6 October 2021 - C-561/19, NJW 2021, 3303 [juris paras. 32 et seq.] - Consorzio Italian Management and Catania Multiservizi). In particular, the case law of the Court of Justice of the European Union has clarified what is meant by the term "personal data" (see the references in paragraphs 22 and 33).
D. The contested judgment must therefore be set aside and the case remanded to the Court of Appeals for a new hearing and decision, including on the costs of the appeal on points of law (Sections 562(1), 563(1), sentence 1 of the German Code of Civil Procedure). The Senate cannot decide the case itself because it is not yet ready for a final decision (Section 563(3) of the German Code of Civil Procedure). Based on the criteria outlined above, the Court of Appeals will have to make further findings as to whether the requested information constitutes personal data.
Koch Löffler Schwonke
Pohl Wille
