LG Freiburg im Breisgau - 8 O 203/24
From GDPRhub
| LG Freiburg im Breisgau - 8 O 203/24 | |
|---|---|
 | |
| Court: | LG Freiburg im Breisgau (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15(1) GDPR Article 15(3) GDPR |
| Decided: | 29.05.2026 |
| Published: | 02.06.2026 |
| Parties: | |
| National Case Number/Name: | 8 O 203/24 |
| European Case Law Identifier: | ECLI:DE:LGFREIB:2026:0529.8O203.24.00 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Landesrecht BW (in German) |
| Initial Contributor: | av |
A court held that two online gambling service providers must grant a user access to their complete gaming and transaction data in accordance with Articles 15(1) and 15(3) GDPR.
English Summary
Facts
A German user (the data subject) brought court proceedings against two online gambling service providers (the controllers) established in Malta. They offered online casino games and sports betting services that were accessible to everyone in Germany. The data subject requested access to the data concerning him processed by the controllers in April 2024. He wanted to obtain certainty about the lawfulness of the processing of his data and determine the extent of his gambling behaviour as well as the claims to which he was entitled against the controllers.
The data subject claimed in court that the controllers had not fulfilled his access request and should therefore be ordered to jointly and severally provide him access to his complete gaming and transaction data pursuant to Articles 15(1) and 15(3) GDPR. The controllers stated that they had already provided the data subject access to the information he had requested and stated that the action should be dismissed.
Holding
The court held in a partial judgment that the action was admissible and largely justified. In order to pay winnings to the data subject, the controllers inevitably had to verify his identity and thus process his personal data. The court ordered the controllers to provide the data subject information about the personal data processed in context of the customer relationship, particularly data concerning the data subject’s gaming history and all transactions on his gaming accounts.
The access request was not manifestly unfounded or excessive within the meaning of Article 12(5) GDPR. The court also held the controllers had not previously provided the data subject access to the required information in accordance with Articles 15(1) and 15(3) GDPR. However, the controllers were legally independent and did not operate the online gambling websites jointly. Therefore, the obligation to fulfil the access request was to be limited to their individual websites.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Court: Freiburg Regional Court (Breisgau), 8th Civil Chamber Date of Decision: May 29, 2026 Case Number: 8 O 203/24 ECLI: ECLI:DE:LGFREIB:2026:0529.8O203.24.00 Document Type: Partial Judgment Source: The player has a right to information from the sports betting provider regarding his bets. Judgment 1. Defendant 1 is ordered to provide the plaintiff with information about the data processed within the framework of the customer relationship existing between the plaintiff and Defendant 1 on the websites https://www. ... .de/de and https://sports. ... .de/de, in particular regarding all game histories and transactions for all of the plaintiff's gaming accounts; Defendant 2 is ordered to provide the plaintiff with information regarding the customer relationship existing between the plaintiff and Defendant 2 on the website https://games. ... .de/de processed data, in particular regarding all game histories and transactions for all game accounts of the plaintiff. Both defendants are ordered to provide information regarding the aforementioned obligation to disclose information about the customer relationship, specifically in addition to the following: a) which personal data of the plaintiff the defendants process; b) for what purpose this data is processed; c) which categories of personal data are processed; d) about the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; e) about the planned duration for which the personal data will be stored and the criteria for determining this duration; f) about the existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by the controller or a right to object to such processing; g) about the existence of a right to lodge a complaint with a supervisory authority; - Page 1 of 13 - h) where the personal data are not collected from the data subject, all available information about the source of the data; i) about the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; j) about whether data are transferred to third countries and what appropriate safeguards are in place in connection with such transfers; k) about the complete payment and gaming history of all the plaintiff's gaming accounts, which must be provided as a copy in a structured, commonly used, and machine-readable format, in particular CSV or Excel format. 2. In all other respects, the action is dismissed at the disclosure stage. 3. The decision on costs is reserved for the final judgment. 4. The judgment is provisionally enforceable upon provision of security in the amount of €500. Statement of Facts 1 The plaintiff is asserting claims against the defendants, providers of online gambling services based in the Republic of Malta under the domains https://www. ... .de/de, https:// sports. ... .de/de and https://games. ... .de/de in connection with his participation in these services. In a multi-stage action, the parties are currently litigating, at the first stage, the plaintiff's requests for information. The plaintiff intends to use the requested information to quantify the claim for reimbursement of lost stakes in the online gambling services offered by the defendants at the third stage. 2 In the past, the defendants offered online gambling services accessible to everyone in Germany based on a Maltese license. The defendant has since obtained a license in Germany (Exhibit K 2). By letter from his attorney dated April 22, 2024 (p. 18, para. 32), the plaintiff requested that the defendants provide him with information within 30 days regarding the data concerning him that was being processed by the defendants. 3 The plaintiff alleges that the defendants had him register multiple times on their websites. The defendants allegedly enabled the plaintiff to participate in online casino games and online sports betting under the usernames "ki-rillka07664", "GranTorinoPro", and "GranTorino79". Using these accounts, the plaintiff allegedly deposited substantial sums of money, estimated at €100,000, and incurred losses. The plaintiff claims it is impossible to reconstruct the extent of his losses based solely on account data. He had no information, in particular no bank statements, from which the date, amount of the deposit, recipient, and type of deposit could be derived. Page 2 of 13 - The plaintiff claims that he made payments to the defendants believing their offer was legally permissible. Only at a later point in time was he made aware of the illegality of the gambling offer. He wants to obtain certainty about the legality of the processing of his data by providing the information and at the same time determine the extent of his gambling behavior and the resulting claims to which he is entitled against the defendants. According to the plaintiff, the gambling and betting contracts he concluded with the defendants are void due to a violation of a statutory prohibition pursuant to Section 134 of the German Civil Code (BGB), and the sums of money he paid in connection with them must be repaid according to the principles of unjust enrichment, Section 812 Paragraph 1 Sentence 1 Alternative 1 of the German Civil Code (BGB). 1 BGB. In light of the lack of authorization from a competent German authority for offering gambling on the internet by the defendants, they would have violated Section 4 Paragraph 4 of the Interstate Gambling Treaty 2012, which is compliant with EU law. 4 The plaintiff requests: 5 I. that the defendants be ordered, jointly and severally, 6 1. to confirm to the plaintiff whether the defendants process personal data concerning the plaintiff and to provide information about this personal data, in particular about all game histories and transactions relating to all of the plaintiff's gaming accounts with the defendants, and to provide information about: 7 a) the purpose for which this data is processed; 8 b) the categories of personal data that are processed; 9 c) about the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; 10 d) about the envisaged period for which the personal data will be stored and the criteria used to determine that period; 11 e) about the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; 12 f) about the right to lodge a complaint with the competent supervisory authority; 13 g) about any available information as to the source of the personal data; 14 h) about the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; 15 2. to inform the plaintiff whether a transfer of data to third countries takes place and what appropriate safeguards are provided in connection with the transfer; - Page 3 of 13 - 16 3. to provide the plaintiff with a copy of the personal data being processed in a commonly used electronic format. The files must be in a structured, commonly used, and machine-readable format, in particular CSV or Excel format; 17 II. the defendants are jointly and severally ordered to affirm under oath that, to the best of their knowledge, they have provided the information required under point I. as completely as they are able; 18 III. The defendants are jointly and severally ordered to: 19 1. pay the plaintiff the balance of all inflows and outflows resulting from the information provided pursuant to Section I. for the ten years preceding the commencement of the action, plus interest at a rate of five percentage points above the respective base interest rate of the European Central Bank per annum, calculated on the respective balance of the previous day; 20 2. indemnify the plaintiff against pre-litigation legal costs in the amount of the statutory fee, calculated on a value in dispute equal to the balance of all inflows and outflows disclosed pursuant to Section I.; 21 3. pay the plaintiff compensation for the delayed provision of information, the amount of which is left to the court's discretion but shall not be less than EUR 500.00. 22 The defendants request that 23 the action be dismissed. 24 They argue that the action is inadmissible as a multi-stage action and that the plaintiff's asserted request for information has no legal basis. In particular, they contend that it does not pursue a legitimate purpose but serves solely to prepare for an action seeking reimbursement of gambling stakes, as outlined in the claim under point III. This, they argue, constitutes a breach of good faith and an abuse of rights by the plaintiff against the defendants, whose licensed offer the plaintiff had previously accepted. Thus, the sole aim is to establish and maintain a business model of "gambling without risk" that is contrary to good faith. Against this background, they contend that the plaintiff's request for information under point I. 3. of the action is not intended to make himself aware of the processing of his personal data and to verify its lawfulness within the meaning of the General Data Protection Regulation. With regard to the other requests for information, there are no legitimate interests of the plaintiff within the meaning of the General Data Protection Regulation; rather, these requests serve solely to conceal the plaintiff's abusive intentions towards the defendant. 25 The plaintiff claims to have registered with defendant no. 1, but does not state when this occurred. This would, however, be important for the plaintiff's claim that he suffered losses participating in unauthorized gambling with the defendants. Both defendants have held valid German licenses for some time. Insofar as the plaintiff claims losses of approximately €100,000, he fails to provide any explanation as to the basis for such a claim. In particular, the plaintiff does not explain to what extent he examined any bank and credit card accounts for possible direct or indirect outflows to gambling providers. 26 The defendants did not operate any websites alternately. Rather, the websites https://www. ... .de/de and https://sports. ... .de/de was always operated by the defendant no. 1), whereas https://games. ... .de/de was always operated by the defendant no. A redirect to the games page did not and does not occur; rather, one had to actively click on it. 27 The defendant's representative stated in the oral proceedings that the request for information had been fulfilled. On December 11, 2023, the plaintiff's attorney requested the corresponding information from the defendant's representatives. Two emails were received from the defendant itself on January 6, 2024. The first email contained an encrypted file with the transaction data, and the second email contained the password to open this transaction data. The plaintiff's attorney responded to this argument in the supplementary written submission of July 23, 2025. 28 The defendants further argue that the present legal proceedings should be stayed in view of the questions arising under EU law and that a preliminary ruling procedure should be initiated before the Court of Justice of the European Union. 29 For further details of the parties' respective submissions, reference is made to the parties' written pleadings and annexes contained in the court file, as well as to the minutes of the oral hearing of 9 July 2025. During this hearing, the court heard, among others, the plaintiff. Reasons for the Decision 30 The action is admissible and largely well-founded with regard to the plaintiff's claim for access to information at the first instance. It was only necessary to differentiate more precisely between the defendants' obligations. The plaintiff can request the requested information from the defendants in the form requested, pursuant to Article 15(1) and (3) of the GDPR. 31 A. The action for disclosure is admissible in the first stage as a multi-stage action within the meaning of Section 254 of the German Code of Civil Procedure (ZPO). 32 1. The international jurisdiction of the Freiburg im Breisgau Regional Court with regard to the right of disclosure asserted in the first stage is based on Article 79(2), second sentence, of the GDPR, irrespective of the plaintiff's legal opinion. According to this provision, a data subject may also bring an action against the controller of the same data processing before the courts of the Member State in which the data subject has his or her habitual residence, unless, which is not applicable in the present case, a public authority of a Member State has acted in the exercise of its official powers. 33 2. The subject-matter jurisdiction of the deciding court is initially derived from Section 71 Paragraph 1 of the Courts Constitution Act (GVG) in conjunction with Section 23 No. 1 of the Courts Constitution Act (GVG), because, taking into account the decisive (still unquantified) claim for performance under point 2, a value in dispute for jurisdictional purposes of over €5,000.00 must be assumed, because the plaintiff claims betting stakes of approximately €100,000. 34 3. Both the material and territorial scope of application of the General Data Protection Regulation (GDPR) are to be affirmed in the present case (cf. in general: (Regional Court of Ellwangen, Judgment of September 3, 2024 – 6 O 65/24 –, juris para. 39 et seq.). 35 a) It must be assumed that the processing is at least partially automated, Art. 2 Para. 1 GDPR. All computer-based processing of personal data is covered by this (see Ehmann/Selmayr/Zerdick, 3rd ed. 2024, GDPR Art. 2 para. 3; see also Schaffland/Wiltfang/Schaffland/Holthaus, General Data Protection Regulation (GDPR)/Federal Data Protection Act (BDSG), 10th Supplement 2024, Art. 2 TEU 2016/679 para. 3; BeckOK DatenschutzR/Bäcker, 49th ed. 01.08.2023, GDPR Art. 2 para. 3; Paal/Pauly/Ernst, 3rd ed. 2021, GDPR Art. 2 para. 5), especially since, according to Recital 15, a “technology-neutral”, and thus a far-reaching approach was chosen. The exceptions laid down in Article 2(2) GDPR, which are not apparent in the present case, must therefore be interpreted narrowly (see CJEU, Judgment of 16 July 2020, Facebook Ireland and Schrems, C-311/18, ECLI:EU:C:2020:559, para. 84; CJEU, Judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C-175/20, ECLI:EU:C:2022:124, para. 40; already regarding Article 3(2) of Directive 95/46/EC, CJEU, Judgment of 11 December 2014, Ryneš, C-212/13). EU:C:2014:2428, para. 29; CJEU, Judgment of 27 September 2017, Puškár, C73/16, EU:C:2017:725, para. 38; CJEU, Judgment of 15 July 2018, Jehovan todistajat, C25/17, ECLI:EU:C:2018:551, para. 37). 36 b) The Regulation is also territorially applicable pursuant to Article 3(1) GDPR, since the defendants have their registered office in the Republic of Malta, a Member State of the European Union. The maintenance of a company headquarters, in the opinion of the adjudicating court, demonstrates the necessary degree of permanence of the establishment as well as the effective pursuit of economic activities in the Member State in question (cf., regarding this requirement, already with regard to Article 4(1)(a) of Directive 95/46/EC, ECJ, Judgment of 1 October 2015, Weltimmo, C-230/14, ECLI:EU:C:2015:639, para. 29; ECJ, Judgment of 28 July 2016, Verein für Konsumenteninformation, C-191/15, ECLI:EU:C:2016:612, para. 77). It can be assumed that the defendants also carry out the data processing operations necessary for the operation of their service via their company headquarters. 37 c) The plaintiff is to be classified as a data subject. According to the legal definition in Article 4 No. 1 GDPR, this refers to an identified or identifiable natural person whose personal data is the subject of a processing operation. The person must be identifiable, at least directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. 38 The plaintiff's submissions, at least implicitly, indicate that he assumes the defendants processed his personal data in connection with his participation in their gambling offer. The court has no doubt that the plaintiff is identifiable to the defendants based on the usernames provided. Page 6 of 13 especially since the court is aware from other similar cases that, due to the payment transactions between player and game provider, a user account must first be verified, thus ensuring the identifiability required by Article 79(2), second sentence, GDPR. 39 d) With regard to the right of access, the defendants are acting as controllers within the meaning of Article 4(7) GDPR. This follows, at least, from the fact that the defendants indicated through the information provided on January 6, 2024, that they themselves are able to provide the requested information. 40 e) The plaintiff, within the meaning of Article 79(2) sentence 2 GDPR in conjunction with Article 79(1) GDPR, is of the opinion that his rights under the General Data Protection Regulation have been violated in the present case due to the failure to provide information pursuant to Article 15(1) GDPR. The actual existence of an infringement is not required by the wording of Article 79(1) GDPR and is thus consistent with German case law on the assessment of facts relevant to both jurisdictions when examining international jurisdiction (see, again, Higher Regional Court of Frankfurt, Judgment of September 12, 2012 – 9 U 36/11, para. 30; Higher Regional Court of Saarbrücken, Judgment of April 28, 2022 – 4 U 91/21, para. 55; Higher Regional Court of Saarbrücken, Judgment of May 12, 2022 – 4 U 81/21, para. 46; also Higher Regional Court of Stuttgart, Judgment of July 25, 2011 – 5 U 60/11, para. 14, each cited according to juris). 41 4. Since the plaintiff maintains his residence in Freiburg im Breisgau, and thus in the district of the competent Regional Court of Freiburg im Breisgau, this court is also locally competent pursuant to Section 44 paragraph 1 sentence 2 BDSG. For although Article 79(2), second sentence, of the GDPR does not itself regulate local jurisdiction, the German legislature has implemented the provision accordingly with regard to local jurisdiction, taking into account the plaintiff's habitual residence (see Gola/Heckmann/Lapp, 3rd ed. 2022, BDSG § 44 para. 2; Kühling/Buchner/Bergt, 4th ed. 2024, BDSG § 44 para. 1; Sydow/Marsch/Kreße, GDPR/BDSG, 3rd ed. 2022, BDSG § 44 para. 2). A person's place of residence corresponds to their place of habitual abode (see Schaffland/Wiltfang/Schaffland/Holthaus, General Data Protection Regulation (GDPR)/Federal Data Protection Act (BDSG), 10th Supplement 2024, Art. 79 EUV 2016/679 para. 8; Kühling/Buchner/Bergt, 4th ed. 2024, GDPR Art. 79 para. 17). 42 5. The action is also admissible as a multi-stage action within the meaning of Section 254 of the German Code of Civil Procedure (ZPO). For, in addition to the cases specifically regulated by law regarding accounting, the submission of an inventory of assets, or the giving of an affidavit, it is recognized that a multi-stage action is also possible if, in preparation for further legal action, a claim for information is asserted, regardless of the legal basis (see BeckOK ZPO/Bacher, 53rd ed. 01.07.2024, ZPO § 254 Rn. 3; Musielak/Voit/Foerste, 21st ed. 2024, ZPO § 254 Rn. 2; Saenger/Saenger, Civil Procedure Code, 10th ed. 2023, § 254 ZPO Rn. 4). Therefore, the right of access under Article 15 GDPR is also covered by the standard (see Anders/Gehle/Anders, 82nd ed. 2024, ZPO § 254 para. 12; Zöller/Greger, Civil Procedure Code, 35th ed. 2024, § 254 ZPO para. 2). Even if one were to assume the inadmissibility of the multi-stage action in the present case because the disclosure was intended to serve the purpose of obtaining other information for the plaintiff's legal action (Brandenburg Higher Regional Court, Judgment of June 16, 2023 – 11 U 9/23 –, para. 7, juris), there would still be an objective joinder of claims and the claim for information would also have to be decided by way of a partial judgment (Federal Court of Justice, Judgment of March 29, 2011 – VI ZR 117/10 –, BGHZ 189, 79-87, para. 14).43 B. The action is largely well-founded at the disclosure stage. The plaintiff has a claim based on Article 15(1) and (3) GDPR. 44 1. The provisions of the General Data Protection Regulation are applicable in this case, both materially and territorially (Articles 2(1) and 3(1) GDPR). 45 2. Pursuant to Article 15(1) GDPR, the data subject has not only the right to obtain confirmation from the controller as to whether or not personal data concerning him or her are being processed, but also, if so, the right to access such personal data. Insofar as the plaintiff requests his or her complete payment and gaming history in a structured, commonly used, and machine-readable format, in particular CSV or Excel format, this constitutes personal data of the plaintiff covered by the regulation. 46 a) The plaintiff is a data subject within the meaning of Article 4 No. 1 GDPR, the defendants are controllers pursuant to Article 4 No. 7 GDPR (see above). 47 b) The requested information regarding the plaintiff's payment and gaming history also constitutes personal data within the meaning of Article 15 para. 1 GDPR in conjunction with Article 4 No. 1 GDPR. 48 Based on the legal definition in Article 4(1) GDPR, the provision covers both personal information used in context, such as identifying characteristics (for example, name, address, and date of birth), external characteristics (such as gender, eye color, height, and weight), or internal states (for example, opinions, motives, desires, beliefs, and value judgments), as well as factual information such as financial and property circumstances, communication and contractual relationships, and all other relationships of the data subject with third parties and their environment (see Higher Regional Court of Cologne, judgment of July 26, 2019 – I-20 U 75/18, para. 304; Regional Court of Stuttgart, judgment of November 4, 2020 – 18 O 333/19, para. 56; Regional Court of Münster, judgment of December 3, 2020 – 115 O 220/18, para. 30; Hamburg Regional Court, judgment of July 6, 2023 - 302 O 24/23, para. 47, each cited according to juris). This broad definition also takes into account the fact that, due to the development of information technology with its comprehensive processing and linking capabilities, there is no longer any such thing as irrelevant data (see: Higher Regional Court of Stuttgart, Judgment of June 17, 2021 - 7 U 325/20, para. 58; Higher Regional Court of Stuttgart, Judgment of June 17, 2021 - 7 U 419/20, para. 59; Regional Court of Munich I, Judgment of April 6, 2020 - 3 O 909/19, para. 94; Regional Court of Stuttgart, Judgment of November 4, 2020 - 18 O 333/19, para. 56, each cited according to juris). 49 The payments received from the plaintiff recorded by the defendants, as well as any profit distributions to the plaintiff, constitute personal data in this respect. The same applies to the game history. Not only does this involve information generated through communication or at least intended contractual relationships between the parties, but, particularly with regard to payment transactions, information is captured not only about the plaintiff's financial circumstances but also their preferred payment methods as an expression of their economic personality. Both the payment transactions with the plaintiff and their gaming history are linked to their user account and, in this respect, attributable to the plaintiff. The defendants, who assume the legality of their offer, would otherwise not have been able to fulfill their own presumed obligations to the plaintiff. To ensure that any winnings are actually paid out to the plaintiff, the defendants necessarily had to verify their identity and attribute the gaming transactions leading to the winnings to them. In light of these circumstances, the plaintiff is also identifiable within the meaning of Article 4 No. 1 GDPR. 50 c) Data processing by the defendants is also taking place. Article 4 No. 2 GDPR defines this as any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 51 Since the plaintiff also had access to the defendants' offer via his user account after registration, the data provided in this context must necessarily have been collected, stored and linked by the defendants. Otherwise, recurring access to the user account using a username and password that must be chosen regularly would not be possible at all. 52 However, in their written submission of July 6, 2025 (p. 295), the defendants argued that they do not jointly operate any of the sites, but rather that the websites https://ww- w. ... .de/de and https://sports. ... .de/de were always operated by defendant no. 1, whereas https://games. ... .de/de was always operated by defendant no. 2. The plaintiff has not substantively refuted this argument and bears the burden of proof regarding the plaintiff's standing to be sued with respect to data processing. Therefore, the legally independent defendants cannot be jointly and severally ordered to provide information, but rather the obligation to provide information should be limited to each individual website. 53 d) The Court is convinced that, with regard to the disputed right to information, the plaintiff also has the right to demand the submission of part of the requested information in the requested structured, commonly used, and machine-readable format, in particular CSV or Excel format, Art. 15 para. 3 sentence 3 GDPR. According to the aforementioned provision, when a request for information is made electronically, the relevant information must first be provided in a commonly used electronic format. The Regulation does not address the specific file format of the information to be transmitted, neither in Art. 15 para. 3 GDPR nor in Art. 12 para. 1 sentence 2 GDPR. A review of the provisions initially only reveals that the controller is granted a choice between electronic, written, or other forms of transmission. In some legal literature, the view is expressed that data copies under Article 15(3) GDPR should only be provided in the form in which the data concerned are held by the controller, without the need for any processing (see Paal/Pauly/Paal, 3rd ed. 2021, GDPR Art. 15 para. 37; Simitis/Hornung/Spiecker gen. Döhmann/Dix, Datenschutzrecht, 1st ed. 2019, Art. 15 GDPR para. 29; BeckOK DatenschutzR/Schmidt-Wudy, 49th ed. 01.08.2024, GDPR Art. 15 para. 83.2; Plath/Kamlah, GDPR/BDSG/TTDSG, 4th ed. 2023, Art. 15 GDPR para. 16). The right of access, however, is aimed at enabling the data subject to verify whether data concerning them is correct and is being processed lawfully, and to effectively exercise their rights under this Regulation (see CJEU, Judgment of 4 May 2023, Austrian Data Protection Authority, C-487/21, ECLI:EU:C:2023:369, paras. 34, 39; CJEU, Judgment of 26 October 2023, FT, C-307/22, ECLI:EU:C:2023:811, para. 73). 54 While Article 15(3), third sentence, GDPR does not explicitly regulate whether and to what extent the data subject may request the transmission of information concerning them in a specific file format, in this case Excel or CSV. Sometimes, however, such a right is recognized as long as it does not result in any additional costs for the controller (see again Simitis/Hornung/Spiecker gen. Döhmann/Dix, Data Protection Law, 1st ed. 2019, Art. 15 GDPR para. 31; Ellwangen Regional Court, judgment of September 3, 2024 – 6 O 65/24 –, juris paras. 55 and 64). The court concurs with this view in light of the purpose of the right of access. Effective exercise of the data subject's rights within the meaning of the cited case law requires that the data in question be as easily readable as possible (see also Ehmann/Selmayr/Ehmann, 3rd ed. 2024, GDPR Art. 15 para. 68). This can also be inferred from the principle of transparency enshrined in Article 12(1), first sentence, GDPR. Furthermore, it would seem pointless if, on the one hand, the data subject were to have the option, pursuant to Article 15(3), third sentence, GDPR, to expressly request electronic transmission, but the specific format of that transmission were entirely at the controller's discretion. 55 This does not contradict Article 20 GDPR. The right of access under Article 15(1) GDPR is already intended to enable the data subject to effectively exercise their rights under the Regulation (see again CJEU, Judgment of 4 May 2023, Austrian Data Protection Authority, C-487/21, ECLI:EU:C:2023:369, paras. 34, 39; CJEU, Judgment of 26 October 2023, FT, C-307/22, ECLI:EU:C:2023:811, para. 73). This, in turn, presupposes, particularly in the case of electronic transmission, that a file format is chosen that can also be read by the data subject (see above Ehmann/Selmayr/Ehmann, 3rd ed. 2024, GDPR Art. 15 para. 68). If a choice for the data subject with regard to the file format were recognized solely within the framework of Article 20 GDPR, the effective exercise of rights beyond the requirements of Article 15(1) GDPR would ultimately also be made dependent on the requirements of Article 20(1) GDPR, and the right of access under Article 15(1) GDPR would thus be restricted beyond its wording, contrary to the purpose of the provision.56 3. The plaintiff's request for information is not to be rejected as an abuse of rights. Regarding the question of whether, and to what extent, the existence of a request for information under Article 15(1) GDPR depends on the grounds pursued by asserting it, the Court of Justice of the European Union has since expressly stated that a request for information does not even require a justification, meaning it can, in principle, be made without grounds, and that, moreover, the pursuit of such objectives as those laid down in the General Data Protection Regulation is not required (see CJEU, Judgment of 26 October 2023, FT/BW, C-307/22, ECLI:EU:C:2023:811, paragraphs 38, 51). Both the Federal Court of Justice (see BGH, judgment of March 5, 2024 - VI ZR 330/21, para. 20, cited according to juris) and subsequently the various Higher Regional Courts (see OLG Koblenz, partial judgment of July 20, 2023 - 10 U 1633/22, para. 61; OLG Cologne, judgment of August 10, 2023 - I-15 U 184/22, para. 32; OLG Nuremberg, judgment of November 29, 2023 - 4 U 347/21, para. 83; OLG Braunschweig, decision of January 12, 2024 - 2 U 106/22, para. 14, each cited according to juris) - Page 10 of 13 - decision of January 12, 2024 - 2 U 106/22, para. 14, each cited according to juris) have adopted this interpretation of applicable Union law in consistent case law ever since. It is therefore irrelevant whether the plaintiff, with the right to information asserted at the first stage, is pursuing a purpose not mentioned in the General Data Protection Regulation. Consequently, he is also not required to provide more details regarding the times of his gaming activity. The plaintiff has the right to information in the present case even with regard to those times when the defendants held a German license. 57 4. The conditions of Article 12(5), second sentence, point (b) GDPR, in the case of a manifestly unfounded or excessive request, which provides for the possibility of refusing to comply with a request for information, are not met. The assertion of the right to information with a view to the long-term objective, already set out in the complaint, of recovering such funds that the plaintiff paid to the defendant in connection with participation in online gambling offered by the defendant, is not an abuse of rights. Even the obvious abuse of rights in asserting such claims does not preclude a preliminary right to information under Article 15(1) GDPR, since otherwise the right to information, which according to the case law of the Court of Justice of the European Union generally exists in a broad scope, would be restricted without sufficient legal basis. Regardless of the question of whether any claims for reimbursement exist in the present case, the prevailing higher court case law (see, most recently, the Berlin Higher Regional Court, decision of July 21, 2023 - 18 U 37/22; Brandenburg Higher Regional Court, judgment of October 16, 2023 - 2 U 36/22; Thuringian Higher Regional Court, judgment of October 17, 2023 - 7 U 1091/22; Cologne Higher Regional Court, judgment of November 17, 2023 - I-19 U 123/22; Oldenburg Higher Regional Court, judgment of November 30, 2023 - 1 U 14/23; Karlsruhe Higher Regional Court, judgment of December 19, 2023 - 19 U 14/23; Karlsruhe Higher Regional Court, judgment of December 22, 2023) - 19 U 7/23; Higher Regional Court of Karlsruhe, Judgment of December 19, 2023 - 19 U 48/23; Higher Regional Court of Bamberg, Judgment of February 27, 2024 - 10 U 22/23 e; Higher Regional Court of Stuttgart, Judgment of April 12, 2024 - 5 U 149/23; Higher Regional Court of Cologne, Judgment of May 6, 2024 - 19 U 70/23; Higher Regional Court of Cologne, Judgment of May 6, 2024 - 19 U 76/23; Higher Regional Court of Cologne, Judgment of May 6, 2024 - 19 U 82/23; Higher Regional Court of Cologne, Judgment of May 6, 2024 - 19 U 97/23; Higher Regional Court of Cologne, Judgment of May 6, 2024 - 19 U 112/23; Cologne Higher Regional Court, Judgment of May 6, 2024 - 19 U 132/23; Stuttgart Higher Regional Court, Judgment of May 24, 2024 - 5 U 74/23; Stuttgart Higher Regional Court, Judgment of May 24, 2024 - 5 U 101/23, each cited according to juris) have not yet assumed that such claims for reimbursement constitute an abuse of rights. Moreover, the First Civil Senate of the Federal Court of Justice has also provisionally taken a similar position in its preliminary ruling of March 22, 2024 (see, in particular, with regard to the argument of "playing without risk," Federal Court of Justice, ruling of March 22, 2024 - I ZR 88/23, juris para. 36). 58 5. The claim was also not satisfied by the information provided on January 6, 2024. Firstly, as Article 15(3), second sentence, GDPR clarifies, the claim can be raised again even after it has been satisfied. The accumulation of such requests is then only relevant within the framework of Article 12(5) GDPR. 59 The defendant also failed to prove that the email fully satisfied the claim in dispute. In his supplementary brief of July 23, 2025, the plaintiff substantively disputed that the email contained the requested information. The plaintiff's representative argued that the transmitted PDF file "consists of a single image which is not machine-readable and is not standard" and that he had pointed this out (Exhibit K 20, p. 281). Therefore, the defense of performance raised by the defendant's representative only during the oral proceedings - Page 11 of 13 - must be considered contested and rejected as untimely pursuant to Section 296 Paragraph 1 of the German Code of Civil Procedure. This is because the defendants did not submit this email and its attachment, preventing the court from independently verifying whether it is sufficient for performance and thus precluding the defendant from providing sufficient evidence. Furthermore, the defendants themselves state (p. 166, para. 103) that the payment and transaction data are available to them as raw systemic data and are not stored as documents. In essence, they themselves argue that the encrypted PDF file sent with the email of January 6, 2024, "does not correspond to the stock of 'raw systemic data' available to them." Insofar as the defendants, in fulfilling the claim under Article 15 GDPR, might limit themselves to transmitting the data in the form in which it originally exists, without producing any further linking of the data, they have not made use of such a limitation. For the purpose of providing information via email on January 6, 2024, they further processed the "raw systemic data" they possess in a manner clearly intended to make it as difficult as possible for the plaintiff to process the data themselves. It requires considerable additional effort to convert the digitally encoded "raw systemic data" from this machine-readable and processing-friendly form into the other digital encoding they chose (an image embedded in an encrypted PDF). Moreover, as explained above, the defendants are not entitled to impose such a limitation to the form of the "raw systemic data" they possess. 61 C. The decision on costs was to be reserved for the final judgment in light of the principle of the unity of the cost decision (see MüKoZPO/Musielak, 6th ed. 2020, ZPO § 301 para. 37; BeckOK ZPO/Elzer, 53rd ed. 01.07.2024, ZPO § 301 para. 68; Zöller/Feskorn, Zivilprozessordnung, 35th ed. 2024, § 301 ZPO para. 21). 62 With regard to the decision on provisional enforceability, the order for security in this respect is based on § 709 sentence 1 ZPO, in light of the operative part of the judgment under point 1. The amount of the security deposit adequately covers any potential claim for damages by the defendant pursuant to Section 717 Paragraph 2 of the German Code of Civil Procedure (see, regarding this standard, Higher Regional Court of Hamm, Partial Judgment of January 9, 2019 - I-12 U 123/18, para. 13, cited according to juris; Anders/Gehle/Schmidt, 82nd ed. 2024, German Code of Civil Procedure Section 709 para. 5; MüKoZPO/Götz, 6th ed. 2020, German Code of Civil Procedure Section 709 para. 4; Saenger/Kindl, German Code of Civil Procedure, 10th ed. 2023, Section 709 para. 2). The court bases its decision on the amount that is likely to correspond to the defendant's expenses in connection with providing the requested information. This corresponds to the highest court's jurisprudence, according to which the amount of security in a judgment ordering disclosure is to be assessed according to the anticipated expenditure of time and costs in enforcing the disclosure order (see Federal Court of Justice, decision of July 13, 2017 - I ZB 94/16, para. 30; Federal Court of Justice, decision of March 1, 2018 - I ZB 97/17, para. 18; Federal Court of Justice, judgment of July 14, 2022 - I ZR 121/21, para. 26; also Higher Regional Court of Stuttgart, judgment of December 12, 2023 - 12 U 216/22, para. 137, each cited according to juris). The court assumed that the defendant, who, as is known to the court, was also confronted with similar requests for information in other proceedings, should be able to provide the requested information in the relevant file format without significant effort. In any case, retrieving the relevant data should, given the large number of comparable requests, constitute routine work, so that, solely with regard to - page 12 of 13 - a minor surcharge was to be applied for any necessary conversion of the file. The court therefore considers an amount of €500.00 to be sufficient. 63 D. A stay of proceedings or a stay of proceedings and referral to the Court of Justice of the European Union pursuant to Article 267(3) TFEU is – contrary to the defendant's view – not warranted. Taking into account the previous ruling of the Court of Justice of the European Union regarding the possibility of successfully asserting a right of access under the General Data Protection Regulation (GDPR) even in connection with purposes not provided for in the recitals of the Regulation (see again CJEU, Judgment of 26 October 2023, FT/BW, C-307/22, ECLI:EU:C:2023:811, paragraphs 38, 51). Moreover, the court deciding the case is not obliged to refer the matter to the Court of Justice of the European Union under Article 267(3) TFEU because it is not a court of last instance. Furthermore, the applicant's interest in a provisionally enforceable decision prevails. - Page 13 of 13 -
