The right of access in accordance with Article 15 of the GDPR
A key right afforded to data subjects is the right of access in accordance with Article 15 of the GDPR, which serves to create transparency and allows data subjects to obtain information concerning the processing of their personal data so that they can determine whether that processing is lawful. The right of access may be asserted without citing grounds and without observing any particular form. But the scope and content of the right of access are disputed and have been the subject of multiple court rulings. In response to the many rulings which have been published in recent weeks, we take this opportunity to keep you informed about the latest developments.
Scope of the right of access
In a Judgment of 15 June 2021 (Case No. VI ZR 576/19) (only in German), the Federal Supreme Court stated that the right of access is broad in scope and clarified that
- the right of access includes all correspondence, as well as internal memos;
- asking for “all data” is a sufficiently precise request and access may not be limited to data which is not yet known to the data subject;
- legal analyses which contain personal data may be subject to Article 15 of the GDPR, but legal assessments which are based on such analyses are not covered by the right of access;
- the right to access is satisfied when the information provided represents the total scope owed according to the stated intent of the information debtor, and an inaccuracy in the information provided does not mean that the right has not been satisfied. Rather, the decisive factor is a declaration from the information debtor that the information is complete.
- If the information provided is noticeably insufficient to cover the subject, the right holder may request additional information.
Once the controller provides information as to whether processing of personal data is taking place, the data subject may ask the controller to provide a copy of the personal data undergoing processing free of charge pursuant to Article 15(3) Sentence 1 of the GDPR in conjunction with Article 12(5) Sentence 1 of the GDPR. The Higher Administrative Court of Munster ruled in a Judgment of 8 June 2021 (Case No. 16 A 1582/20) that a copy must be provided in a common electronic format in addition to a paper copy. The Higher Administrative Court of Munster also favors a broad interpretation of the right of access, under which the controller is required to provide information about all existing personal data. Merely telling the data subject whether personal data is being stored and, if so, which and/or providing only the information specified in Article 15(1) a‑h of the GDPR (the narrow interpretation) is not enough in the view of the Higher Administrative Court of Munster.
But in the view of the Federal Labor Court in its Judgment of 27 April 2021 (Case No. 2 AZR 342/20), the right of access may not be extended indiscriminately (only in German). The court refused to grant a motion requiring the defendant to provide all e‑mails which are the subject of processing and which were sent to the employee’s work e‑mail address or which mentioned him by name, ruling that the motion was not specific enough. This limitation of the right of access, which is being asserted more and more frequently by departing employees, serves to prevent abuse and is therefore a welcome development.
In a Judgment of 17 March 2021 (Case No. 21 Sa 43/20), the District Labor Court of Baden-Württemberg (only in German) ruled that a request from an employee to provide “data relating to conduct and performance” was specific enough. This conclusion was based on the case law relating to § 87(1) No. 6 of the Works Constitution Act, as the court reasoned that the employee was clearly seeking information about data which was not in his personnel file, which the employee would have been able to view in accordance with § 83 of the Works Constitution Act. The court ruled that employees cannot be expected to specify precisely which personal data they are seeking. However, such wide-ranging requests for information should be difficult to justify before the Labor Courts in light of the clarification from the Federal Labor Court.
With regard to third-country transfers, the Labor Court of Wiesbaden ruled in a Judgment of 31 May 2021 (Case No. 93 C 3382/20) (only in German) that, while Article 15(2) of the GDPR provides for notification in case of a third-country transfer, a negative report is not required in the absence of such a transfer. But insofar as the contention is made that personal data had been transferred to third countries or international organizations, the right of access cannot be satisfied without a negative report.
Impact of the data subject’s right of access on product development
We therefore advise companies to adapt their products and corporate structures to account for the enforceability of rights of access and to take this possibility into account when developing their products and services. The need for data to be exportable poses particular requirements in terms of the technology which companies use. Companies will need to establish appropriate interfaces and automatically generate data packets in order to manage the growing number of requests for information.
No damage claim for late information
In two Judgments on 1 July 2021 (Case Nos. 15 O 372/20 and 15 O 355/20, available at Beck-online), the District Court of Bonn leaves open the question as to whether a delay in providing information constitutes a violation in terms of Article 82(1) of the GDPR. As grounds for this ruling, the District Court of Bonn points out in both decisions that a damage claim in accordance with Article 82 of the GDPR only comes into consideration in case of processing which violates the GDPR. But the court argues conclusively that a delay in answering a request for information is not a violation of the GDPR which arises from the processing itself. The court notes that the same is true e.g. for the violation of notification requirements in data protection law and points out that just because a controller violates Articles 12–15 of the GDPR does not mean that the processing which gave rise to the right of access was itself in violation of the Regulation. The Higher Regional Court of Vienna takes a different view, however. In its Judgment of 7 December 2020 (Case No. 11 R 153/20f, 154/20b) (PDF only in German) the court awarded the plaintiff a damage claim in the amount of € 500 for violation of the right of access in accordance with Article 15 of the GDPR, finding that the delay in providing the information was responsible for causing material damages.
It remains to be seen whether the German courts will adopt the view of the Higher Regional Court of Vienna. But in light of the fact that the data protection authorities may impose fines on companies which are late in responding to requests for information, compliance with Article 15 of the GDPR should not be taken lightly.
back