Paul Strobach – Court Ruling (Germany, 2022)

The controller is a railway company. It has video cameras installed in some of its trains which are active during the operation of the trains. The recordings are automatically deleted after 48 hours. The data subject boarded one of these trains on the 27th of April 2021. By email of the same day the data subject requested the controller to hand over the video footage and, to this end, not delete it. The controller, however, deleted the data within the deletion period of 48 hours and, therefore, refused to provide the requested information to the data subject. As a consequence, the data subject filed a lawsuit with the District Court of Pankow (Amtsgericht Pankow - AG Pankow) requesting damages in the amount of €350 according to Article 82 GDPR. The District Court rejected the claim of the data subject. It held that the controller did not violate Article 15(1) GDPR. It found that the controller's refusal to answer the request of access was legitimate according to [https://www.gesetze-im-internet.de/bgb/__275.html § 275(2) BGB] (German Civil Code) under which a debtor can refuse performance insofar as this requires an effort which, taking into account the legal relationship of the parties and the requirements of good faith, is grossly disproportionate to the creditor's interest in performance. The court concluded that, since the data subject was already aware of the processing, its circumstances and its content, the purpose of Article 15 GDPR was already largely fulfilled. Furthermore the court reasoned that, because of the short retention period of 48 hours, a loss of control of the data subject over his personal data was not apparent. The data subject had also requested the restriction of the processing under Article 18(1)(c) GDPR in order to prevent the controller from deleting the footage while the access request was handled. On this point, the court found that preventing the automatic deletion and filtering out the recording of the data subject would have tak