Court case 7 A 170/24 – Court Ruling (Germany, 2026)

A firearms authority (the controller) sent the holder of a hunting license and a firearms ownership card (the data subject) information required under Articles 13 and 14 GDPR after the permits granted to the data subject had been transferred to it from another authority. The data processed by the controller included the name, date of birth, and contact information of the data subject. The data subject objected to the use of their home address for mailing letters in February 2024. In March, they requested the restriction of processing under Article 18(1)(d) GDPR. As the controller did not respond, the data subject repeated this request in April 2024 and made an access request under Article 15 GDPR. The data subject repeated the access request in June 2024 and criticised the controller for the failure to meet the deadline set forth in Article 12(3) GDPR. The data subject filed a lawsuit in July 2024, stating the controller had infringed Article 12(3) GDPR - this lawsuit has already been subject to a court decision. In August 2024, the controller provided the data subject certain information. The data subject maintained this information was incomplete and requested access to all their data processed by the controller. The data subject then filed another lawsuit in August, where they claimed the controller should to supplement the information provided - this lawsuit has also already been subject to a court decision. In a third lawsuit - subject to the decision at hand filed in October 2024 before the Administrative Court Osnabrück - the data subject claimed the information they requested access to on 21 August 2024 had not yet been provided to them and should have been provided by September 2024. The controller maintained the repeated access requests had been excessive. The court held that the lawsuit was well founded and stated that controller had failed to take action on the data subject’s access request within the one-month period required by Article 12(3) GDPR. The controller had not informed the data subject about an extension of the deadline either. In addition, the controller had failed to make a decision to not act on the access request and inform the data subject about this pursuant to Article 12(4) GDPR. Furthermore, the court held that even if the request is excessive within the meaning of Article 12(5) GDPR - the controller is required to react to the request. In the present case, there was strong evidence suggesting that the access request made on 21 August 2024 could be considered excessive. However, the court pointed out that this would merely have entitled the controller to charge a reasonable fee or refuse to act on the request which would require a respective information to the data subject. Therefore, the controller cannot remain entirely passive.