Tax Authority – Court Ruling (Germany, 2021)

The controller is a tax authority. In October 2020, the data subject requested to be provided with copies of files containing his personal data pursuant to Article 15(3) GDPR. The controller refused, arguing that the right to access of Article 15 GDPR does not entail all internal processes of the controller or the right to have all exchanged correspondence, which is already known to the data subject, printed out and sent again. The Finance Court Berlin-Brandenburg (Finanzgericht Berlin-Brandenburg - FG Berlin-Brandenburg) fully rejected the data subject's claim. The court began with clarifying that - contrary to the controller's position - the GDPR is applicable to the administration of direct taxes in the area of tax administration. Furthermore, all information contained in a tax file is generally personal data. Then, the court held that the data subject rights enshrined in Article 15(3) GDPR do not entitle the data subject to be provided with copies of personal data in the form of (electronic) duplicates of entire files by the controller. According to the court, Article 15(3) GDPR only contains a right to the catalogue information pursuant to Article 15(1)(a)-(h) GDPR. The FG Berlin-Brandenburg based that decision on a narrow interpretation of the provision, arguing that Article 15(1) and 15(3) GDPR do not contain two independent rights but rather a single right. First, the court argued that it was sufficient for the data subject to receive a complete overview of the data reproduced in the draft document - i.e. including personal data contained in the legal analysis - in an intelligible form instead of a copy of the document or the original file containing that data. This had been decided by the [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=8085503 CJEU] in the context of the previous Data Protection Directive and had to be applied for the purpose of the interpretation of