VG Berlin - 1 K 187/21: Difference between revisions
mNo edit summary |
mNo edit summary |
||
| Line 62: | Line 62: | ||
}} | }} | ||
The Administrative Court of Berlin held that the controller | The Administrative Court of Berlin held that it is not sufficient for the controller to provide only an abstract overview of the categories of personal data and the data recipients following an access request as the data subject cannot review the lawfulness of the data processing. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
On 20 October 2020, the data subject requested information regarding his personal data stored by the data controller and requested copies of all records containing this data. In a letter from 18 November 2020, the controller provided the data subject with information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it. | |||
In a letter from 4 December 2020, the data subject argued that the information provided was late and incomplete as it only listed his so-called master data ('Stammdaten'), whereas he asserted a right to receive copies of all documents held by the data controller in which his personal data is listed. He additionally requested from the controller to delete all of his personal data. | |||
In a letter from 28 December 2020, the data controller informed the data subject that it could not delete the electronically stored personal data of the data subject as this was part of a file inventory and could only be deleted after the retention period expires. | |||
The data controller was of the opinion that the provided information following the data subject's request was complete. | |||
Subsequently, the data subject claimed that, that under the GDPR he is entitled to receive copies of all documents held by the controller containing his personal data. On March 15, 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin). | Subsequently, the data subject claimed that, that under the GDPR he is entitled to receive copies of all documents held by the controller containing his personal data. On March 15, 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin). | ||
Revision as of 13:00, 26 March 2024
| VG Berlin - 1 K 187/21 | |
|---|---|
 | |
| Court: | VG Berlin (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15 GDPR Article 15(1) GDPR |
| Decided: | 06.02.2024 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 1 K 187/21 |
| European Case Law Identifier: | ECLI:DE:VGBE:2024:0206.1K187.21.00 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Juris (in German) |
| Initial Contributor: | Julia |
The Administrative Court of Berlin held that it is not sufficient for the controller to provide only an abstract overview of the categories of personal data and the data recipients following an access request as the data subject cannot review the lawfulness of the data processing.
English Summary
Facts
On 20 October 2020, the data subject requested information regarding his personal data stored by the data controller and requested copies of all records containing this data. In a letter from 18 November 2020, the controller provided the data subject with information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it.
In a letter from 4 December 2020, the data subject argued that the information provided was late and incomplete as it only listed his so-called master data ('Stammdaten'), whereas he asserted a right to receive copies of all documents held by the data controller in which his personal data is listed. He additionally requested from the controller to delete all of his personal data.
In a letter from 28 December 2020, the data controller informed the data subject that it could not delete the electronically stored personal data of the data subject as this was part of a file inventory and could only be deleted after the retention period expires.
The data controller was of the opinion that the provided information following the data subject's request was complete.
Subsequently, the data subject claimed that, that under the GDPR he is entitled to receive copies of all documents held by the controller containing his personal data. On March 15, 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin).
Holding
In the judgment, the Court highlighted the purpose of the right to information under Article 15(1) GDPR, as indicated, among other places, in Recital 63, is to enable data subjects to be aware of the processing of their personal data, thereby allowing them to subsequently verify not only the accuracy of this data but also the lawfulness of its processing. Therefore, the Court agreed with the data subject that in order to review the lawfulness of the data processing, a mere abstract overview of the processed data is not sufficient as it was present in the case at hand when the data subject only received information that covered the master data stored in the data controller's IT systems. Rather, in order to be able to verify the lawfulness of the data processing in each individual case, the Court held that it is necessary to provide specific information on the context in which the data was processed.
The Court acknowledged that responding to Article 15(1) GDPR requests is combined with a substantial effort for controllers. However, due to the importance of the - generally unconditional - right to information under Article 15(1) GDPR, a refusal by the controller to comply with a request for information due to the disproportionately high effort required for its fulfillment is only permissible in strictly limited exceptional cases. The court held that this might occur in cases of an obviously significant disparity between the efforts required to fulfill the right to information and the information interest of the data subject. However, the Court found that this is not the case as the data subject wants to understand how the controller passed on personal data to third parties in order to possibly assert the deletion or restriction of the processing of the data against these third parties. This can only be taken into account by the controller handing over copies of the relevant documents to the data subject; an abstract overview of the recipients of the data is not sufficient. Against this background, the objection of abuse of rights, which is subject to equally strict requirements also did not apply.
The Court concluded that the controller is obliged to provide the data subject with information about the data subject's personal data processed by providing a copy of this data.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
If you see this message, you do not have JavaScript activated in your browser. Please activate JavaScript to use the citizen service.
