Court case 3 U 2906/20 – Court Ruling (Germany, 2021)

In accordance with Article 15(3) GDPR the claimant, as the data subject, demanded in a pre-action measure that the defendants provide them with copies of all of the claimant’s personal data held by the defendants. In particular, the claimant requested copies of telephone notes, memos, protocols, e-mails, letters and underwriting documents for capital investments. The defendants subsequently provided information on the claimant’s personal data in accordance with Article 15(1) GDPR. However, they did not provide the claimant with copies of the documents. The refusal to provide the copies was based on the defendants' argument that Article 15(3) GDPR only governs the method in which information is provided, but does not confer an entitlement on the data subject to be provided with copies. In the subsequent trial, the claimant widened their claim and demanded that the defendants be ordered to provide them with copies of all personal data, including the requested notes, memos and documents. At trial, the court found that the data in question was in fact personal data and ordered the defendants to provide the claimant with copies of all her personal data. The defendants appealed to the OLG Munich to revoke the decision of the trial court. The OLG Munich had to decide on the question if a claim under Article 15 GDPR entitles the data subject to be provided with copies of their personal data and whether Article 15(3) GDPR contains an independent entitlement to have a copy of the personal data handed over to the data subject. The appellate court dismissed the defendants' application and upheld the trial court's decision to order the defendants to provide the claimant with copies of all her personal data.  The Court found that an individual who is entitled to information under Article 15(1) GDPR is also, independently, entitled to receive copies pursuant to Article 15(3) GDPR. Both paragraphs concern the same subject matter – personal data – but are different entitlements with different legal effects. Moreover, the structure of the Regulation suggests that Article 15(3) GDPR is a separate claim. With this paragraph, the Regulation does not just further specify the right to information according to Article 15(1) GDPR, but instead introduces an independent provision. The wording of Article 15(3) creates an obligation on the controller to provide the data subject with copies of the personal data. Regarding this obligation, the Court further specified that “the subject matter is not merely an abstract enumeration of the existing information”. Rather, the data subject is entitled to be provided with the information in the form in which it is available to the controller. Regarding the personal nature of the copies, the court confirmed that according to Article 4(1) GDPR and the ECJ’s case law, the definition of personal data must be constructed broadly and potentially includes all types of information, both of objective and subjective nature, in the form of opinions or assessments, provided that the information relates to the data subject. In the present case, the claimant’s letters and e-mails to the defendants must in principle be regarded as personal data within the meaning of Article 4(1) GDPR. Telephone notes, memos and protocols which record what the claimant said to the defendants on the phone or in personal conversations must also be classified as personal data.