Paul Strobach – Court Ruling (Germany, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a railway company did not have to provide video footage to a passenger who requested it. The court found that keeping the video would have been too burdensome for the company. This matters because it shows that companies may not always have to fulfill data access requests if it's too difficult.
What happened
The railway company deleted requested video footage within its standard 48-hour period and refused to provide it to the passenger.
Who was affected
A train passenger who requested access to video footage of themselves was affected by the company's refusal.
What the authority found
The court ruled that the company's refusal to provide the footage was justified due to the effort required being disproportionate to the passenger's interest.
Why this matters
This decision suggests that companies might not need to fulfill data access requests if doing so is excessively burdensome, highlighting the balance between data rights and operational feasibility.
GDPR Articles Cited
National Law Articles
The controller is a railway company. It has video cameras installed in some of its trains which are active during the operation of the trains. The recordings are automatically deleted after 48 hours. The data subject boarded one of these trains on the 27th of April 2021. By email of the same day the data subject requested the controller to hand over the video footage and, to this end, not delete it. The controller, however, deleted the data within the deletion period of 48 hours and, therefore, refused to provide the requested information to the data subject. As a consequence, the data subject filed a lawsuit with the District Court of Pankow (Amtsgericht Pankow - AG Pankow) requesting damages in the amount of €350 according to Article 82 GDPR. The District Court rejected the claim of the data subject. It held that the controller did not violate Article 15(1) GDPR. It found that the controller's refusal to answer the request of access was legitimate according to [https://www.gesetze-im-internet.de/bgb/__275.html § 275(2) BGB] (German Civil Code) under which a debtor can refuse performance insofar as this requires an effort which, taking into account the legal relationship of the parties and the requirements of good faith, is grossly disproportionate to the creditor's interest in performance. The court concluded that, since the data subject was already aware of the processing, its circumstances and its content, the purpose of Article 15 GDPR was already largely fulfilled. Furthermore the court reasoned that, because of the short retention period of 48 hours, a loss of control of the data subject over his personal data was not apparent. The data subject had also requested the restriction of the processing under Article 18(1)(c) GDPR in order to prevent the controller from deleting the footage while the access request was handled. On this point, the court found that preventing the automatic deletion and filtering out the recording of the data subject would have tak
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Paul Strobach in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Paul Strobach - Germany (2022). Retrieved from cookiefines.eu
Last updated: