Court case M 32 E 26.3990 – Court Ruling (Germany, 2026)

The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a private publishing company and overseen by several co-editors, including two professors at a Bavarian university (the alleged controller). The data subject received an email pointing out inconsistencies in the external review process in April 2026. On 7 May, the data subject submitted an access request under Article 15 GDPR to the university and requested a complete copy of their personal data processed in connection with the publishing process. The work email accounts of the two aforementioned university professors were explicitly identified as storage locations in the access request. The university rejected the access request in a decision dated 20 May 2026: it argued that it was not the controller within the meaning of Article 4(7) GDPR. According to the university, only the co-editors of the journal and the publishing company could be classified as controllers with regard to the storage of personal data in connection with publishing activities. On 26 May, the data subject filed a both a lawsuit and an application for a preliminary injunction before the Administrative Court Munich. In the application, they requested a preliminary injunction ordering the university to retain all the data subject's personal data until the main proceedings regarding the right to access would be legally concluded. As the data subject sought to secure their right of access with the application, they argued that their right to a preliminary injunction arose from Articles 5(2), 15, and 32 GDPR. The court rejected the data subject's application for a preliminary injunction: the requirements laid down in [https://www.gesetze-im-internet.de/vwgo/ § 123(1)(1) of the German Code of Administrative Court Procedure (VwGO)] were not fulfilled. First, the court held that the role of the university in the processing at issue could be left open in connection with the application for a preliminary injunction. Instead, it should be determined in the main proceedings whether the university was acting as a controller within the meaning of Article 4(7) GDPR. The court pointed out, however, that an employee using a work email account to process personal data in connection with their private activities generally determines the purpose and the means of the processing and is therefore acting as the sole controller. Second, the court concluded that the data subject did not have a right of access under Article 15 GDPR. The court weighed the data subject's right to access against the university professors' legitimate interests in maintaining the confidentiality of their communication and their general right to privacy. As the requested disclosure of information would constitute a significant infringement of the professors' right to privacy, the court held that the legitimate interests of the university professors prevailed over the data subject's right of access. According to the court, this conclusion was supported by Article 23(1)(i) GDPR and [https://www.gesetze-bayern.de/Content/Document/BayDSG Article 10(2)3) of the Bavarian Data Protection Act (BayDSG)], as these provisions restrict the right of access. The national provision states that information shall not be disclosed to the extent that personal data or the fact of its storage must be kept confidential to protect the data subject or due to the overriding legitimate interests of third parties. The court also referred to Article 15(4) GDPR to support its argumentation. Pursuant to this provision, the right to receive a copy of personal data processed shall not adversely affect the rights and freedoms of others. In addition, the court pointed out that Article 15 GDPR must be interpreted in light of the fundamental rights guaranteed in the EU Charter.