Law firm – Court Ruling (Germany, 2021)

The data subject is a client of a law firm, acting as a controller. The controller sued the data subject for payment of attorney's fees. The data subject counterclaims for their right of access pursuant to Article 15 GDPR, in particular to provide a copy of the personal data pursuant to Article 15(3) GDPR, as well as their right to receive compensation for damages suffered pursuant to Article 82 GDPR. The controller is of the opinion that it already provided the data subject with a copy of personal data as all incoming and outgoing documents were sent to the data subject without undue delay. Furthermore, it claimed that there is only a right to copies of those data that contain concrete information about the data subject. The controller also believes that the claim is time-barred. According to the data subject, the controller did not provide a copy of all personal data. The right to a copy of the personal data also includes a copy of the manual files of the controller. The data subject claims that they are entitled to the payment of damages suffering for the delayed and still incomplete provision of the personal data. The court held that the data subject is entitled to claim for the controller to receive a copy of all personal data including a copy of personal data contained in the manual files. Since the counterclaim was served to the controller on 4 February 2021 and thus before the expiry of a standard limitation period of three years, calculated from the entry into force of the GDPR, the claim cannot be time-barred. The court further held that the data subject is not entitled to claim compensation for the delayed right of access. The violation of the GDPR alone is not sufficient to trigger a claim for damages. Rather, the data subject affected by a data protection violation must have suffered a noticeable disadvantage. There must be an objectively comprehensible impairment of personal interests that carries a certain weight and of a certain significance. It is undisputed that the non-material disadvantages referred to in Recital 75 GDPR did not arise for the data subject.