OLG Köln - 15 U 184/22
From GDPRhub
| OLG Köln - 15 U 184/22 | |
|---|---|
 | |
| Court: | OLG Köln (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 79(1) GDPR Article 82(1) GDPR |
| Decided: | 10.08.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 15 U 184/22 |
| European Case Law Identifier: | ECLI:DE:OLGK:2023:0810.15U184.22.00 |
| Appeal from: | LG Bonn (Germany) 9 O 158/21 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | NRWE (in German) |
| Initial Contributor: | n/a |
The Higher Regional Court Cologne mandated a controller to provide full access as per Article 15 GDPR, but rejected the claim for damages under Article 82 GDPR due to insufficient evidence of harm.
English Summary
Facts
The dispute involved a data subject seeking complete access under Article 15 GDPR from the controller (a hospitla). Initially, the claim included multiple defendants and medical liability claims, which were dropped in favour of the data disclosure claim. The data subject alleged that the first defendant had not provided complete information, particularly concerning data shared with their liability insurance company.
Holding
The Higher Regional Court Cologne held that the data subject was entitled to complete access under Article 15 GDPR. The court found that the previous access was incomplete, especially regarding the internal correspondence with the liability insurance. The data subject's claim for damages under Article 82 GDPR was, however, dismissed due to the lack of concrete demonstration of the alleged immaterial harm.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Operative part of the judgment:
1. The plaintiff's appeal is partially amended, and the judgment of the Regional Court Bonn dated 29.08.2022 - 9 O 158/21 is revised and rephrased as follows:
The defendant 1) is ordered to provide the plaintiff with a complete data disclosure in accordance with Art. 15 GDPR, particularly regarding the personal data of the plaintiff transmitted to the liability insurance of defendant 1), with the claim being dismissed in other respects.
2. The costs of the first-instance proceedings, including the costs of the independent evidence proceedings at the Regional Court Bonn - 9 OH 13/19, are borne by the plaintiff. The costs of the appeal proceedings are mutually canceled between the intervening party supporting the appeal and defendant 1).
3. The judgment is provisionally enforceable without security.
4. Revision is not permitted.
5. The first-instance determination of the value of the dispute in the order of the Regional Court dated 02.11.2022 - 9 O 158/21 - is amended ex officio, and the value of the dispute for the first-instance proceedings is set at "up to 35,000 EUR".
Reasons:
I.
The plaintiff's intervening party - also her legal representative - is only pursuing data protection information and compensation claims against defendant 1) in the appeal proceedings, while the medical liability claims primarily pursued against both defendants in the first instance are not further pursued. For further details of the factual and legal situation as well as the first-instance final applications, reference is made to the statement of facts in the contested decision dated 29.08.2022 (pages 693 et seq. of the case file).
The Regional Court dismissed the action in its entirety with this - published in juris - judgment. Insofar as relevant for the appeal proceedings, it assessed the data protection information request as too indefinite for an enforcement action from the outset, among other reasons because it should not refer to a file component subject to earlier deletion under the Retention Ordinance (here: "Annex 31 to the pleading of 21.11.2019"). The plaintiff's declarations of settlement dated 21.04.2022, 28.07.2022, 05.08.2022, and 12.08.2022 did not contribute to the definiteness of the request; the declarations of 21.04.2022 and 05.08.2022 were themselves too indefinite, among other reasons because it was not clear which specific statements in the pleadings of defendant 1) dated 14.04.2022 and 01.08.2022, including attachments, were considered as (partial) fulfillment. The declaratory request contained in the unilateral declaration of settlement dated 28.07.2022 with reference to the letter of defendant 1) dated 12.07.2022 was unfounded because the claim was originally inadmissible due to indefiniteness. The ancillary request, thus presented for decision, was admissible - as the scope of the information derived from the law - but unfounded, whereby a right to a copy under Art. 15(3) GDPR - not covered by the information request and named as an independent right in Art. 15(4) GDPR - was not in dispute. Also, "information" beyond the plaintiff's "personal data" within the meaning of Art. 15(1) GDPR, such as that under Art. 15(1)(c) GDPR, was not sought; the right to information had to be distinguished from the right to access processed "personal data." The information right thus understood was fulfilled by the final statement of defendant 1) in the oral hearing on 12.08.2022 (pages 2 f. of the protocol = pages 666 f. of the case file). Regarding correspondence and notes, a negative information declaration was made, stating that they contained no personal data beyond the information provided. Legal analyses could indeed contain personal data, but the assessment of the legal situation based on this data was not information about the data subject (ECJ, 17.07.2014 - C-141/12 and C-372/12, juris). Thus, a complete negative information declaration was provided, not a partial one in a specific area. Moreover, the plaintiff did not request a sufficiently definite supplement to the previously provided information but a comprehensive one, which defendant 1) had initially considered as completely fulfilled, albeit erroneously in law. Claims under Art. 82 GDPR were excluded; the plaintiff did not demonstrate non-material damage. Initially, it should be noted that most information was known through the transmission of treatment records and participation in the expert procedure, etc. The additional information provided by the defendants was not claimed to be relevant to the plaintiff or that the delay could have impaired her. As the information request was initially inadmissible due to lack of sufficient definiteness, the costs related to the §91a-ZPO parts were also to be borne by the plaintiff. For further details of the reasoning, reference is made to pages 8 et seq./16 et seq. of the contested decision's grounds (pages 700 et seq./708 et seq. of the case file).
The intervening party filed an appeal on 30.09.2022 against the judgment served on the plaintiff on 30.08.2022, simultaneously declaring his intervention on the plaintiff's side and with the addition "in my position as intervening party" and thus continues to pursue the plaintiff's first-instance final applications (only) to items 4 and 5, aiming also at correcting the cost decision and specifying a minimum amount for the compensation request only to 500 EUR (page 4 of the appeal brief = page 8 of the case file). The intervening party criticizes that the original claim for information - with its fulfillment, defendant 1) also being in default at the time of filing the action according to the Regional Court - was as admissible as the later, only adapted version of the requests in response to the changed procedural situation, especially since the treatment records referred to in the OH procedure (Annex 31) had been filed and the Regional Court could have addressed its concerns by connecting the documents with the title. In this respect, no cost liability of the plaintiff can be established even concerning § 91a ZPO. The Regional Court failed to recognize that a party that does not know the data to be disclosed, as here, should not be required to perform the impossible in filing a claim, and any "remaining uncertainties" should be resolved in enforcement proceedings under § 888 ZPO. Contrary to the case law of the Federal Labour Court (BAG), affected parties here are not to be referred to step-by-step claims (§ 254 ZPO), but information requests should be formulated according to the wording of Art. 15(1) GDPR. The partial settlement declarations referring to specific pleadings of defendant 1) were - contrary to the Regional Court - sufficiently clear. It cannot be blamed on the plaintiff's side that defendant 1) presented in a "staccato style" and had to be "virtually forced to provide the information." It cannot be that the defendants are "able to drive the plaintiff side ahead of them by continually feeding 'information bites' into the ongoing legal dispute." If viewed differently, the Regional Court violated the right to be heard by failing to provide timely indications before the oral hearing, refusing a grace period for submissions, denying the requested adjournment, and failing to reopen the proceedings because, in the hearing held under § 128a ZPO, a "detailed revised claim request" could not be presented in "fragmented 'bookkeeping work.'" A "positive request" for open information positions with a "kind of numerus clausus of data" could not be made as defendant 1) did not disclose her (remaining) data stock. It was certain that something was "open," especially as the parties had argued during the legal dispute that defendant 1) had to disclose data exchanged with the liability insurer. In fact, for the first time during the oral hearing on 12.08.2022, defendant 1) referred to "Y." and D. L. C. and did not clarify which data had been transmitted to "Y." or who "Y." specifically was, as "Y." is a parent company. At least the auxiliary request recognized as unobjectionable by the Regional Court according to the hearing protocol (page 2 = page 666 of the case file) was justified. For one, the claim for "complete data disclosure under Art. 15 GDPR" rightfully included the right to a copy. For this reason alone, there was no fulfillment by defendant 1)'s statement during the hearing on 12.08.2022, especially as she only invoked "protected data" and Art. 15(4) GDPR without verifiable submission, admitted the existence of further correspondence with the insurer, and thus did not provide a "statement of completeness" within the meaning of the BGH decision of 15.06.2021 - VI ZR 576/19, juris para. 19. This applies even more as defendant 1) stated on record that a claim to information about internal (telephone) memos or correspondence with third parties did not exist in principle. If the Regional Court found that defendant 1) "explained that such correspondence and notes do not contain personal data beyond the already provided information," this is mere speculation, and at least the offered witness evidence
by the plaintiff from the data protection officer should have been followed.
Regarding Art. 82(1) GDPR, there is damage from the first-instance submission in the form of intentional and prolonged disregard of the rights of the data subject under Art. 15 GDPR. It must be recognized that with increasing time and a "stubborn refusal" by the responsible body (disobedience to law), the damage element gradually forms.
For further details of the plaintiff's submissions in the appeal proceedings, reference is made to the appeal brief with the intervention declaration (pages 4 et seq. of the Senate file), the appeal statement (pages 181 et seq. of the Senate file), the briefs dated 07.10.2022 (pages 46 et seq. of the Senate file), 31.10.2022 (pages 156 et seq. of the Senate file), 01.12.2022 (pages 229 et seq. of the Senate file), 09.12.2022 (pages 238 et seq. of the Senate file), 20.12.2022 (pages 261 et seq. of the Senate file), 06.03.2023 (pages 314 et seq. of the Senate file), 12.07.2023 (pages 325 et seq. of the Senate file) and 17.07.2023 (pages 341 et seq. of the Senate file), as well as the unsolicited brief dated 20.07.2023 (pages 376 et seq. of the Senate file).
The plaintiff's intervening party finally requests, in essence,
under partial amendment of the judgment of the Regional Court Bonn dated 29.08.2022 - 9 O 158/21 -
1) to order defendant 1) to provide the plaintiff with a complete data disclosure in accordance with Art. 15 in conjunction with Art. 4(1) and (6) GDPR - beyond the treatment documentation in Annex 31 to the pleading of 21.11.2019 in the case LG Bonn 9 OH 13/19 - with the proviso that this claim has been partially settled by the partial settlement declarations dated 21.04.2022 (page 386 of the case file), 28.07.2022 (page 602 of the case file), 05.08.2022 (page 651 of the case file) and 12.08.2022 (page 667 of the case file);
alternatively,
to order defendant 1) to provide the plaintiff with a complete data disclosure in accordance with Art. 15 GDPR, particularly regarding the personal data of the plaintiff transmitted to the liability insurance of defendant 1);
2. to order defendant 1) to pay the plaintiff an appropriate amount of pain and suffering based on Art. 82(1) GDPR for the delayed provision of the data disclosure in accordance with Art. 15 GDPR, plus interest at five percentage points above the base rate since 27.07.2022.
Defendant 1) requests,
to dismiss the appeal.
Defendant 1) defends the contested decision by deepening her first-instance submissions. Referring to an annex could not fulfill the requirements for definiteness. For further details of the defendant's submissions in the appeal instance, reference is made to the appeal response (pages 286 et seq. of the Senate file) and the brief dated 17.07.2023 (pages 334 et seq. of the Senate file).
The file LG Bonn - 9 OH 13/19 - was available in scanned form and was the subject of the oral hearing.
II.
The appeal is only successful to the extent stated in the operative part.
1. The appeal is admissible. It was timely filed by the intervening party, who simultaneously effectively declared his intervention in accordance with § 66(2) ZPO (§ 70 ZPO). In the absence of a complaint pursuant to § 71 ZPO, the prerequisites for the intervention are not to be reviewed ex officio even in a constellation such as the present one, where the attorney acting for his legal expenses insured client in the first instance pointed out only extremely abstract-hypothetical regression risks from the client or the legal expenses insurer in the specific case (BGH, 16.09.2021 - IX ZR 144/19, juris) (see pages 2 f. of the intervention brief = pages 7 f. of the Senate file), at least not ex officio (consistent case law, see BGH, 21.11.2018 - I ZR 10/18, NJW 2019, 1803 para. 11). Nevertheless, even semi-tangible regression claims against a lawyer are considered a case of legal interest within the meaning of § 66 ZPO (Wieczorek/Schütze/Mansel, ZPO, 5th ed., § 66 para. 63d). There are no other admissibility concerns. In cases of so-called mixed cost decisions after partial settlement within the meaning of § 91a ZPO - as here - the cost decision can also be uniformly reviewed by the appellate court along with the main appeal (instead of all Zöller/Althammer. ZPO, 34th ed. 2022, § 91a para. 56 with references).
Insofar as the Regional Court regarded the right to a copy under Art. 15(3) GDPR as an independent right and therefore not included in the contested information request (pages 16 f. of the judgment) - which is not convincing in light of the following - it is procedurally harmless that the plaintiff did not proceed against this in a timely manner with applications under § 321 ZPO. If, as here, a judgment is appealed on other grounds, a party can also reassert a claim that has been terminated by the expiration of the deadlines under § 321(2) ZPO and the resulting termination of lis pendens in the appellate instance by amending or extending the claim (§§ 263, 264 No. 2, 533 ZPO) (instead of all Musielak/Voit/Musielak, ZPO, 20th ed. 2023, § 321 para. 10 with references). In particular, there are no doubts about the expediency.
2. The appeal is (only) justified with regard to the information request - whereby the Senate has interpreted the claim and has ruled according to the economically and substantively absolutely identical auxiliary request because it is not about a declaration of settlement in other respects. This is based on the following considerations:
a) The information request is admissible. Contrary to the Regional Court, there are no concerns about the definiteness (§ 253(2)(2) ZPO) of the initial, broadly formulated request from the complaint (page 3 of the case file), to order the defendant to provide the plaintiff with "complete data disclosure in accordance with Art. 15 in conjunction with Art. 4(1) and (6) GDPR - beyond the treatment documentation Annex 31 to the pleading of 21.11.2019," the subsequent various partial settlement declarations and/or the also broadly formulated auxiliary request.
aa) A claim is sufficiently definite if it specifically designates the asserted right, thereby defining the scope of the court's decision-making authority (§ 308(1) ZPO), makes the content and extent of the res judicata effect of the desired decision (§ 322 ZPO) recognizable, does not shift the plaintiff's risk of losing the case to the defendant due to avoidable imprecision, and finally, allows enforcement from the judgment without a continuation of the dispute in the enforcement proceedings. The requirements for specifying the subject matter of a claim depend on the specifics of the applicable substantive law and the circumstances of the individual case. The requirements for the definiteness of the claim must be determined by balancing the defendant's protected interest in being able to fully defend against the claim and its interest in legal clarity and certainty regarding the decision's effects with the plaintiff's equally protected interest in effective legal protection (see BGH, 13.10.2015 - VI ZR 271/14, NJW 2016, 1094 para. 19 with references).
bb) According to these principles, in cases asserting an information right under Art. 15(1) second half-sentence GDPR, it is generally sufficient if the claim is directed at providing complete information about the personal data processed by the defendant corresponding to the wording of the provision; specifying these data is generally not required (correctly König, CR 2019, 295, 296 [= juris para. 9-11]; still undecided BGH, 15.06.2021 - VI ZR 576/19, juris para. 32; BAG, 16.12.2021 - 2 AZR 235/21, NJW 2022, 960 para. 27). For reasons of effective legal protection, there must be a way to enforce the right arising from Art. 15(1) second half-sentence GDPR procedurally. It is crucial to consider that the claimant seeks to obtain the information through the request to accurately specify the personal data processed by the respondent (see BAG, 16.12.2021 - 2 AZR 235/21, NJW 2022, 960 para. 26). Therefore, the provision of such information cannot be a prerequisite for the procedural enforcement of the claim. Whether, in cases where the controller processes a large amount of information about the data subject, the controller may require the data subject to specify which information or processing activities the request relates to, with regard to the last sentence of recital 63 GDPR, does not need to be decided here. This does not generally concern the procedural question of the definiteness of the claim. The
plaintiff's side has sufficiently clarified on page 12 of the complaint (page 13 of the case file), referring to the pre-litigation information requests, and also in the further court proceedings (e.g., page 4 of the brief dated 26.11.2021, page 123 of the case file, page 2 of the brief dated 24.01.2022, page 218 of the case file, pages 1 et seq. of the brief dated 21.04.2022, pages 386 et seq. of the case file; page 5 of the brief dated 12.05.2022, page 423 of the case file, pages 1 et seq. of the brief dated 14.06.2022, pages 467 et seq. of the case file) what the remaining issues are.
cc) Finally, the definiteness of the claim was not precluded by the plaintiff initially limiting it to data disclosure "beyond the treatment documentation Annex 31 to the pleading of 21.11.2019" (see also BGH, 15.06.2021 - VI ZR 576/19, a.a.O. para. 31, 32 to a similar reference to annexes in the claim there) or later making partial settlement declarations referring to specific pleadings. On the one hand, such annexes and/or pleadings submitted to the case file could be connected to a court title to avoid initial concerns about definiteness. Ultimately, this is not required, as the Senate here has also ruled quite openly by interpreting the claim, because - as also in other cases of "unfinished" information claims not yet fully fulfilled - the claim can be simply enforced openly for the required information (quasi as the owed "end result"). The initial limitation of the request or the reference to partial settlements evidently only takes into account that the defendant has already provided certain information; by the limitation, it is merely clarified that the defendant does not need to repeat the already provided information, but the plaintiff continues to consider the information otherwise incomplete and thus continues to sue for "complete" information. As the Senate has also stated in its judgment of today in 15 U 78/22 (intended for publication), a limitation by referring to already provided partial information before or during the proceedings and/or other clarifications does not necessarily have to be included in the claim and tenor, as one may simply file a broadly formulated claim in line with the wording of the law and everything else is then only a question of the fulfillment defense (§ 362(1) BGB) in the court proceedings or in the enforcement proceedings under § 888 ZPO after appropriate titling. It is not reasonable to expect a plaintiff in information claims - like here - to include the already provided information in detail in the claim and to specifically identify an exact "remaining stock" of open positions. It is only necessary - to the point of the justification of the claim - that at the time of the last oral hearing, there is still no complete fulfillment of the information claim in terms of § 362(1) BGB. If this is not the case, one can be openly sentenced accordingly. The Senate expressly does not overlook that it might be simpler and clearer for the judicial handling if the plaintiff initially included a large number of very specific points in their information request and during the legal dispute, with the defendant only addressing some points, made partial settlement declarations and the court then decided on the remaining open points in a contentious manner and could rule on these individually. However, in view of Art. 79(1) GDPR, the enforcement of information claims must not be unnecessarily complicated. This is even more so since even with other information claims, one often proceeds rather leniently when filing a claim and resolves doubtful questions in § 888 ZPO proceedings. In practically not uncommon cases of only "piecemeal" fulfillment of information claims under Art. 15 GDPR, it must, therefore, be possible to continue to sue and rule for the information - more precisely, the still unfulfilled part - more or less broadly, whereby a settlement declaration "otherwise" may often only be thought of or expressly declared if necessary, but ultimately only relevant at the cost level or in the case of a unilateral settlement declaration only if it is disputed whether a specific item of information claimed was materially covered by the information claim at all. These questions do not arise here, and everything intended is covered by the - in this respect ultimately - identical main and auxiliary request. Moreover, against an otherwise overly extensive "precision obligation" speaks a contrario from § 34(4) BDSG, which provides for a more precise specification only for public bodies (thus BeckOK-DatenschutzR/Schmidt.-Wudy, Art 15 para. 47).
dd) The contested claim also includes - contrary to the Regional Court - without a clarifying formulation in the request/tenor (as in the case of the BGH, 15.06.2021 - VI ZR 576/19, juris: "Data disclosure by providing in copy - alternatively in text form") and/or a reference to Art. 15(3) GDPR, the right to a copy. According to the European Court of Justice's case law of 04.05.2023 - C-487/21, EuZW 2023, 575 - Art. 15(3) GDPR only sets out the practical modalities for fulfilling the information obligation from Art. 15(1) GDPR. Art. 15 GDPR, therefore, cannot be interpreted as granting a different right in its paragraph 3 sentence 1 than the one provided for in paragraph 1 (see ECJ, a.a.O., para. 31 f.). According to this decision, there is particularly no room for the assumption of the Federal Labour Court (BAG) that a request for the provision of a data copy under Art. 15(3) GDPR must indicate which personal data a copy is requested for, and that a claimant who cannot provide a more precise specification is therefore obliged to initially demand information about which personal data the respondent processes through a step-by-step claim in order to then, based on this information, submit a request for the provision of a copy of the data resulting from the information (judgments of 16.12.2021 - 2 AZR 235/21, NJW 2022, 960 para. 33; of 27.04.2021 - 2 AZR 342/20, NJW 2021, 2379 para. 20 f.; already critically Lembke/Fischels, NZA 2022, 513, 519 f.; see also Senate, 17.11.2022 - 15 U 159/21, n.v.). Art. 15 GDPR rather contains a unified right to information. Moreover, the plaintiff had already referred to her right to a copy in the first instance (see, e.g., brief dated 29.05.2022, page 450 of the case file). This unified claim must generally be enforceable without specifying the personal data - as here. Since the claim is aimed at an unsubstantiated action, it is to be enforced under § 888 ZPO (see Lembke/Fischels, NZA 2022, 513, 520). If a debtor ordered to provide information provides further information and copies of data to the creditor, it must be examined in enforcement proceedings whether the titled information claim has then been finally fulfilled. Any difficulties arising from this are not a peculiarity of data protection law but may also occur in similar forms with other information claims.
b) Contrary to the Regional Court, the plaintiff's information claim - the defendant 1) having recognized in the course of the proceedings that the claim under Art. 15(1) and (3) GDPR extends beyond the handover of treatment records (see also Senate, 10.08.2023 - 15 U 149/22, intended for publication) - has not yet been completely fulfilled until the end.
aa) Insofar as the Regional Court differentiated under Art. 15(1) GDPR between an allegedly only claimed right to information about the plaintiff's "personal data" and claims for other "information," this did not do justice to the claim. The claimed "complete" data disclosure correctly covered the entire "information about these personal data and the following information" required by law within the meaning of the norm. However, the defendant 1) fulfilled this claim in the disputed points during the proceedings: Where the plaintiff claims that the specific insurance company from the Y. Group was not disclosed, this is incorrect. From Annex 14 (AH I of the accompanying file = page 390 of the scan) = letter from defendant 1) dated 14.03.2019, it is clear that liability insurance is directly with Y. Versicherungs-AG, and the plaintiff's representative was therefore asked to fill out a consent and confidentiality release form, which the plaintiff's representative complied with by email on 31.03.2019 (Annex 15, 16f., AH I of the accompanying file). Regarding D. C., it was disclosed that it is a central office for handling or liability management (page 666 of the case file). If the plaintiff misses "contact details" of the named legal entities, such information is not covered by Art. 15(1)(c) GDPR. This follows from a contrario from Art. 13(1)(a) and (b) on the one hand and (e) on the other; further "contact details" are therefore not to be provided here.
bb) The plaintiff's side waived further information on correspondence of defendant 1) with her lawyers (page 3 of the brief dated 14.06.2022, page 469 of the case file); therefore, no further information claims can be pursued in this regard
.
cc) The information claim on the "administrative data" in the hospital administration and billing area is fulfilled, with the brief dated 01.08.2022, including attachments (pages 625 et seq. of the case file).
dd) However, the information claim - contrary to the statements of the Regional Court - regarding (internal) correspondence of defendant 1) with the liability insurer remains unfulfilled; this also with regard to Art. 15(3) GDPR. The statements made in the oral hearing before the Regional Court do not suffice for assuming a "statement of completeness" within the meaning of the Federal Court of Justice's case law on Art. 15(1) GDPR. This is because defendant 1) has, until the end, evidently been of the incorrect opinion that there is no need to provide information on such documents, that there is no need to provide copies, and that Art. 15(4) GDPR applies overall anyway (see, for example, pages 1 et seq. of the brief dated 14.04.2022, pages 379 et seq. of the case file, pages 1 f. of the brief dated 23.05.2022, pages 427 f. of the case file, page 2 of the brief dated 08.06.2022, page 463 of the case file). According to the European Court of Justice's decision of 04.05.2023 - C-487/21, EuZW 2023, 575 para. 41 et seq., reproduction of excerpts from (even internal) documents or entire documents or excerpts from databases containing personal data, among other things, that are the subject of processing, must be provided if this proves "indispensable," such as when contextualization of the processed data is necessary to ensure their comprehensibility. In the case of a potential conflict between the right to complete and comprehensive information about personal data on the one hand and the rights or freedoms of other persons on the other hand, these legal positions must be clearly weighed against each other; as far as possible, methods of transmitting the personal data that do not infringe the rights or freedoms of other persons should be chosen, whereby these considerations must not lead to the complete refusal of any information to the data subject. The form and modalities of information provision and, in particular, the question of whether the defendant must also provide the plaintiff with excerpts from the relevant documents or even entire documents (see ECJ a.a.O.), do not need to be clarified currently. This is because, as mentioned, there are no verifiable statements from defendant 1) about processing personal data in connection with the relevant correspondence. If it is merely stated that no further processing of personal data is found in the internal documents than in the already provided documents themselves, this does not suffice. It would be necessary to at least clarify that here no further information/documents containing the plaintiff's personal data were processed in the internal handling of the alleged liability case or in correspondence with the liability insurer (e.g., additional information through further questioning of the treating doctors or other personnel on detailed questions, other medical records from the ward, medical data, additional X-rays or lab results, etc.), which go beyond the - provided - treatment file. There are no sufficiently clear statements on this until the end.
ee) Likewise unfulfilled is the - clear from the beginning - request for information on potential processing of personal data in any telephone, meeting, and processing notes on the damage case. No "statement of completeness" can be recognized by the Senate either.
c) A declaration of partial settlement otherwise and/or inclusion of the consistent partial settlements in the tenor is not required here as stated at the beginning.
d) The plaintiff's medical liability claim, not challenged with her own appeal, finally does not make the information request pursued by the intervening party at the time of the last oral hearing yet legally abusive ("excessive") within the meaning of Art. 12(5)(2)(b) GDPR. Regardless of the question that even pursuing medical liability (and thus "non-data protection-related") purposes alone might not have invalidated such a request (Advocate General, final submission of 20.04.2023 - C-307/22, BeckRS 2023, 7659; open BGH, 29.03.2022 - VI ZR 1352/20, ZD 2022, 497), the information request here serves at least also to satisfy other data protection concerns of the plaintiff, which are not hindered at least by the final dismissal of the liability claims. The plaintiff would still be able to pursue claims under Art. 16 et seq. GDPR or to initiate supervisory authority measures based on the information provided, should there be reason to do so after information provision. The unsubstantiated burden on defendant 1) otherwise is not sufficiently specifically raised and therefore does not argue in favor of them in the balance.
3. The compensation request under Art. 82(1) GDPR, which is pursued in the appeal with an adjustment of the minimum amount expectations, was rightly dismissed by the Regional Court. The Chamber rightly assumed that the plaintiff is not entitled to compensation for non-material damage under Art. 82(1) GDPR.
While the Senate has decided that breaches of information obligations under Art. 15 GDPR can certainly form a basis for a compensation claim under Art. 82(1) GDPR (Senate, 14.07.2022 - 15 U 137/21, NJW-RR 2023, 564 para. 14). However, the Regional Court correctly found that in the case at hand - unlike in the case underlying the Senate decision (see a.a.O. para. 15) - there is no plausible submission as to how and why the plaintiff should have suffered non-material damage. Such submission is also not dispensable. The European Court of Justice has decided in its judgment of 4 May 2023 - C-300/21, EuZW 2023, 580 - that a mere breach of the provisions of the GDPR is not sufficient to justify a compensation claim. Instead, the person affected by a breach of the GDPR must demonstrate that the breach has had negative consequences for them and that these consequences constitute non-material damage (a.a.O., para. 50), whereby it does not depend on the severity. The plaintiff has not provided this proof, despite the Regional Court's notice of 12.08.2022 (page 665 of the case file) - even until the appeal proceedings. Simply a long delay and presumed "bad faith" do not constitute "damage."
Contrary to the plaintiff's submissions, the situation here is different from the above-cited Senate decision in the judgment of 14.07.2022 - 15 U 137/21, NJW-RR 2023, 56: Unlike there, no uncertainty burdening the plaintiff about the progress of negotiations in connection with the settlement of a damage case or an important legal proceeding arose here. This is because the medical liability process was not measurably affected here in light of the treatment records handed over from the outset, and this is also not specifically claimed. The occasionally implied "loss of control" in the sensitive application area of health-related data with the resultant uncertainty of the plaintiff due to delayed information (page 4 of the brief dated 23.07.2022, page 539 of the case file) is not comprehensible in view of the provision of all treatment records, especially since the legally insured plaintiff did not pursue the data protection information request any further and from the outset it was consistently clear that here only the liability management and the liability insurer were involved in the overall process surrounding the medical liability issue and otherwise only the normal billing process took its course; any "loss of control" is also, therefore, unlikely.
4. Regarding the first-instance cost decision - but including the costs of the OH proceedings - §§ 100(1), 92(2)(1), 91a ZPO apply. Although the evidently defaulting defendant 1) will bear the costs of the entire information lawsuit proportionally in the context of the equity decision under § 91a ZPO, the information request at the beginning of the proceedings made up less than 1/10 of the total dispute value of the first-instance proceedings with a clear focus on medical liability law. The marginally excessive comprehensive dismissal request has caused at most minimal additional costs. Therefore, a unified cost decision against the plaintiff appears appropriate under § 92(2)(1) ZPO alone.
For the costs of the appeal proceedings, the cost decision is based on § 92(1)(1) ZPO. Although the plaintiff as the main party has formally become a party to the appeal proceedings, the intervening party as the instigator solely and exclusively bears the costs in cases of sole failure (OLG München, 22.11.2018 - 11 W 1501/18, NJW-RR 2019, 512 para. 9; Zöller/Althammer, ZPO, 34th ed. 2022, § 67 para. 6; Zöller/Herget, § 101 para. 4 with references). In view of approximately equal shares of loss, a cost cancellation appears appropriate here; the court costs of the appeal proceedings thus fall half to the intervening party and half to defendant 1) and otherwise all bear their out-of-court costs themselves.
5. The decision on provisional enforceability is based on §§ 708 No. 10, 711, 713 ZPO.
6. The unallowed brief of the intervening party dated 20.07.2023 does not warrant reopening the oral hearing; the legal questions addressed have been answered above by the Senate.
7. The admission of the revision is not required as the case neither has fundamental importance nor does it require a decision by the revision court
for the development of the law or the assurance of uniform case law. Insofar as the Federal Labour Court has assumed that a request for the provision of a data copy under Art. 15(3) GDPR must indicate which personal data a copy is requested for (BAG, 16.12.2021 - 2 AZR 235/21, NJW 2022, 960 para. 33; 27.04.2021 - 2 AZR 342/20, NJW 2021, 2379 para. 20 f.), this has been superseded by the judgment of the European Court of Justice of 04.05.2023 - C-487/21, a.a.O.
8. After the discussion in the oral hearing - unlike in the two parallel proceedings also negotiated on 20.07.2023 inadvertently not recorded in the protocol - the first-instance value determination had to be corrected according to § 63(3)(1)(2) GKG with regard to the information claim. The "lump sum" valuation of 5,000 EUR by the Regional Court appears at least here excessive. According to § 48(2)(1) GKG, in non-pecuniary civil disputes, the value of the dispute is to be determined at the court's discretion, taking into account all circumstances of the individual case, in particular the scope and importance of the matter and the parties' financial and income circumstances; the general clause applicable in administrative court proceedings under § 52(2) GKG is expressly not applicable (see Senate, 16.09.2022 - 15 U 87/22, juris para. 2). In the case at hand, a precise determination is unnecessary because, even at the beginning of the proceedings, in light of the already provided records to the plaintiff before further information provision, a determination above an amount of 3,000 EUR was undoubtedly inappropriate, rather significantly less. There is a lack of specific submissions regarding financial and asset circumstances and especially the importance of the open information claim for the plaintiff, who was undisputedly able to dispose of all necessary treatment records for the medical liability process for a long time and also does not complain about the lack of further important information in this regard.
Dispute value for the appeal proceedings: 1,000 EUR (500 EUR for the payment claim + 500 EUR for "remaining information"; proportional costs for § 91a ZPO according to the so-called difference method [Musielak/Voit/Flockenhaus, ZPO, 20th ed. 2023, § 91a para. 55] are negligible here).
