VG Berlin - 1 K 187/21

VG Berlin - 1 K 187/21
Court:	VG Berlin (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 15 GDPR Article 15(1) GDPR
Decided:	06.02.2024
Published:
Parties:
National Case Number/Name:	1 K 187/21
European Case Law Identifier:	ECLI:DE:VGBE:2024:0206.1K187.21.00
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	Juris (in German)
Initial Contributor:	Julia

The Administrative Court of Berlin held that a refusal by the controller to comply with a request for information (Art. 15 GDPR) due to the disproportionately high effort required for its fulfillment is only permissible in narrowly defined exceptional cases.

English Summary

Facts

In October 2020, the data subject (plaintiff) requested information regarding his personal data stored by the data controller (defendant) and requested copies of all records containing this data. In a letter from November 2020, the controller provided the data subject with information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it.

After receiving the controller's letter, the data subject argued that the information provided is incomplete as it only listed his so-called master data ('Stammdaten'), whereas he asserted a right to receive copies of all documents held by the data controller in which his personal data is listed. He additionally demanded from the controller to delete all of his personal data. The data controller was of the opinion that the provided information following the data subject's request was complete.

Subsequently, the data subject claimed that, that under the GDPR he is entitled to receive copies of all documents held by the defendant containing his personal data. On March 15, 2021, the data subject filed a lawsuit against the controller.

Holding

In the judgment, the court highlighted the purpose of the right to information under Article 15(1) of the GDPR, as indicated, among other places, in Recital 63 of the GDPR, is to enable data subjects to be aware of the processing of their personal data, thereby allowing them to subsequently verify not only the accuracy of this data but also the legality of its processing. Therefore, the court agreed with the data subject that for a legality check, a mere abstract overview of the processed data is not sufficient as it was present in the case at hand when the data subject only received information that covered the master data stored in the data controller's IT systems. Rather, in order to be able to verify the legality of data processing in each individual case, the court held that it is necessary to provide specific information on the context in which the data was processed.

The court acknowledged that responding to Art. 15(1) GDPR requests is combined with a substantial effort for controllers. However, due to the importance of the - generally unconditional - right to information under Article 15(1) GDPR, a refusal by the controller to comply with a request for information due to the disproportionately high effort required for its fulfillment is only permissible in narrowly defined exceptional cases. The court held that this might occur in cases of an obviously significant disparity between the efforts required to fulfill the right to information and the information interest of the data subject.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

If you see this message, you do not have JavaScript activated in your browser. Please activate JavaScript to use the citizen service.