Recent case law on the right of access in accordance with Artic­le 15 of the GDPR

The right of access in accordance with Artic­le 15 of the GDPR

A key right affor­ded to data sub­jects is the right of access in accordance with Artic­le 15 of the GDPR, which ser­ves to crea­te trans­pa­ren­cy and allows data sub­jects to obtain infor­ma­ti­on con­cer­ning the pro­ces­sing of their per­so­nal data so that they can deter­mi­ne whe­ther that pro­ces­sing is lawful. The right of access may be asser­ted wit­hout citing grounds and wit­hout obser­ving any par­ti­cu­lar form. But the scope and con­tent of the right of access are dis­pu­ted and have been the sub­ject of mul­ti­ple court rulings. In respon­se to the many rulings which have been published in recent weeks, we take this oppor­tu­ni­ty to keep you infor­med about the latest developments.

Scope of the right of access

In a Judgment of 15 June 2021 (Case No. VI ZR 576/19) (only in Ger­man), the Fede­ral Supre­me Court  sta­ted that the right of access is broad in scope and cla­ri­fied that

  • the right of access includes all cor­re­spon­dence, as well as inter­nal memos;
  • asking for “all data” is a suf­fi­ci­ent­ly pre­cise request and access may not be limi­t­ed to data which is not yet known to the data subject;
  • legal ana­ly­ses which con­tain per­so­nal data may be sub­ject to Artic­le 15 of the GDPR, but legal assess­ments which are based on such ana­ly­ses are not cover­ed by the right of access;
  • the right to access is satis­fied when the infor­ma­ti­on pro­vi­ded repres­ents the total scope owed accor­ding to the sta­ted intent of the infor­ma­ti­on deb­tor, and an inac­cu­ra­cy in the infor­ma­ti­on pro­vi­ded does not mean that the right has not been satis­fied. Rather, the decisi­ve fac­tor is a decla­ra­ti­on from the infor­ma­ti­on deb­tor that the infor­ma­ti­on is complete.
  • If the infor­ma­ti­on pro­vi­ded is noti­ce­ab­ly insuf­fi­ci­ent to cover the sub­ject, the right hol­der may request addi­tio­nal information.

Once the con­trol­ler pro­vi­des infor­ma­ti­on as to whe­ther pro­ces­sing of per­so­nal data is taking place, the data sub­ject may ask the con­trol­ler to pro­vi­de a copy of the per­so­nal data under­go­ing pro­ces­sing free of char­ge pur­su­ant to Artic­le 15(3) Sen­tence 1 of the GDPR in con­junc­tion with Artic­le 12(5) Sen­tence 1 of the GDPR. The Hig­her Admi­nis­tra­ti­ve Court of Muns­ter ruled in a Judgment of 8 June 2021 (Case No. 16 A 1582/20) that a copy must be pro­vi­ded in a com­mon elec­tro­nic for­mat in addi­ti­on to a paper copy. The Hig­her Admi­nis­tra­ti­ve Court of Muns­ter also favors a broad inter­pre­ta­ti­on of the right of access, under which the con­trol­ler is requi­red to pro­vi­de infor­ma­ti­on about all exis­ting per­so­nal data. Mere­ly tel­ling the data sub­ject whe­ther per­so­nal data is being stored and, if so, which and/or pro­vi­ding only the infor­ma­ti­on spe­ci­fied in Artic­le 15(1) a‑h of the GDPR (the nar­row inter­pre­ta­ti­on) is not enough in the view of the Hig­her Admi­nis­tra­ti­ve Court of Munster.

But in the view of the Fede­ral Labor Court in its Judgment of 27 April 2021 (Case No. 2 AZR 342/20), the right of access may not be exten­ded indis­cri­mi­na­te­ly (only in Ger­man). The court refu­sed to grant a moti­on requi­ring the defen­dant to pro­vi­de all e‑mails which are the sub­ject of pro­ces­sing and which were sent to the employee’s work e‑mail address or which men­tio­ned him by name, ruling that the moti­on was not spe­ci­fic enough. This limi­ta­ti­on of the right of access, which is being asser­ted more and more fre­quent­ly by depar­ting employees, ser­ves to pre­vent abu­se and is the­r­e­fo­re a wel­co­me development.

In a Judgment of 17 March 2021 (Case No. 21 Sa 43/20), the Dis­trict Labor Court of Baden-Württemberg (only in Ger­man) ruled that a request from an employee to pro­vi­de “data rela­ting to con­duct and per­for­mance” was spe­ci­fic enough. This con­clu­si­on was based on the case law rela­ting to § 87(1) No. 6 of the Works Con­sti­tu­ti­on Act, as the court reaso­ned that the employee was cle­ar­ly see­king infor­ma­ti­on about data which was not in his per­son­nel file, which the employee would have been able to view in accordance with § 83 of the Works Con­sti­tu­ti­on Act. The court ruled that employees can­not be expec­ted to spe­ci­fy pre­cis­e­ly which per­so­nal data they are see­king. Howe­ver, such wide-ranging requests for infor­ma­ti­on should be dif­fi­cult to jus­ti­fy befo­re the Labor Courts in light of the cla­ri­fi­ca­ti­on from the Fede­ral Labor Court.

With regard to third-country trans­fers, the Labor Court of Wies­ba­den ruled in a Judgment of 31 May 2021 (Case No. 93 C 3382/20) (only in Ger­man) that, while Artic­le 15(2) of the GDPR pro­vi­des for noti­fi­ca­ti­on in case of a third-country trans­fer, a nega­ti­ve report is not requi­red in the absence of such a trans­fer. But inso­far as the con­ten­ti­on is made that per­so­nal data had been trans­fer­red to third count­ries or inter­na­tio­nal orga­niza­ti­ons, the right of access can­not be satis­fied wit­hout a nega­ti­ve report.

Impact of the data sub­jec­t’s right of access on pro­duct development

We the­r­e­fo­re advi­se com­pa­nies to adapt their pro­ducts and cor­po­ra­te struc­tures to account for the enforcea­bi­li­ty of rights of access and to take this pos­si­bi­li­ty into account when deve­lo­ping their pro­ducts and ser­vices. The need for data to be exporta­ble poses par­ti­cu­lar requi­re­ments in terms of the tech­no­lo­gy which com­pa­nies use. Com­pa­nies will need to estab­lish appro­pria­te inter­faces and auto­ma­ti­cal­ly gene­ra­te data packets in order to mana­ge the gro­wing num­ber of requests for information.

No dama­ge cla­im for late information

In two Judgments on 1 July 2021 (Case Nos. 15 O 372/20 and 15 O 355/20, available at Beck-online), the Dis­trict Court of Bonn lea­ves open the ques­ti­on as to whe­ther a delay in pro­vi­ding infor­ma­ti­on con­sti­tu­tes a vio­la­ti­on in terms of Artic­le 82(1) of the GDPR. As grounds for this ruling, the Dis­trict Court of Bonn points out in both decis­i­ons that a dama­ge cla­im in accordance with Artic­le 82 of the GDPR only comes into con­side­ra­ti­on in case of pro­ces­sing which vio­la­tes the GDPR. But the court argues con­clu­si­ve­ly that a delay in ans­we­ring a request for infor­ma­ti­on is not a vio­la­ti­on of the GDPR which ari­ses from the pro­ces­sing its­elf. The court notes that the same is true e.g. for the vio­la­ti­on of noti­fi­ca­ti­on requi­re­ments in data pro­tec­tion law and points out that just becau­se a con­trol­ler vio­la­tes Artic­les 12–15 of the GDPR does not mean that the pro­ces­sing which gave rise to the right of access was its­elf in vio­la­ti­on of the Regu­la­ti­on. The Hig­her Regio­nal Court of Vien­na takes a dif­fe­rent view, howe­ver. In its Judgment of 7 Decem­ber 2020 (Case No. 11 R 153/20f, 154/20b) (PDF only in Ger­man) the court award­ed the plain­ti­ff a dama­ge cla­im in the amount of € 500 for vio­la­ti­on of the right of access in accordance with Artic­le 15 of the GDPR, fin­ding that the delay in pro­vi­ding the infor­ma­ti­on was respon­si­ble for caus­ing mate­ri­al damages.

It remains to be seen whe­ther the Ger­man courts will adopt the view of the Hig­her Regio­nal Court of Vien­na. But in light of the fact that the data pro­tec­tion aut­ho­ri­ties may impo­se fines on com­pa­nies which are late in respon­ding to requests for infor­ma­ti­on, com­pli­ance with Artic­le 15 of the GDPR should not be taken lightly.


Stay up-to-date

We use your email address exclusively for sending our newsletter. You have the right to revoke your consent at any time with effect for the future. For further information, please refer to our privacy policy.