Court case 4 U 1905/21 – Court Ruling (Germany, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a health insurance company was not required to provide information about premium increases under GDPR. The court decided that requests solely to check premium changes are excessive. This ruling clarifies the limits of data access rights under GDPR.
What happened
The court decided that a request for information about insurance premium increases was excessive and not covered by GDPR access rights.
Who was affected
A customer of a private health insurance company seeking information about premium adjustments.
What the authority found
The Higher Regional Court of Dresden ruled that the right to access data cannot be used to obtain information solely for verifying premium increases, as it is considered excessive.
Why this matters
This decision clarifies that GDPR access rights are intended to verify the lawfulness of data processing, not for other purposes like checking premium changes. It sets a precedent for how access rights are interpreted in similar cases.
GDPR Articles Cited
The controller is a private health insurance company. The data subject is a customer of the controller. The parties are in dispute about the validity of several increases to the insurance premiums. The data subject filed a lawsuit with the Regional Court of Leipzig (Landgericht Leipzig - LG Leipzig) requesting the refund of overpaid premiums as well as information on all adjustments to the premiums in the form of notification letters sent to the data subject and supplements to the insurance policy. The controller rejected both claims. The Regional Court of Leipzig dismissed the data subject's claim almost entirely. As a consequence, the data subject appealed this decision to the Higher Regional Court of Dresden (Oberlandesgericht Dresden - OLG Dresden). The Higher Regional Court of Dresden dismissed the plaintiffs appeal. The court found that the right to access cannot be used to obtain information about premium increases. For its reasoning the court exclusively quoted a decision of the Higher Regional Court of Hamm (Oberlandesgericht Hamm - OLG Hamm) from the 15th November 2021 (case nr. 20 U 269/21). In the quoted decision, the OLG Hamm held that a controller is allowed to reject a request to access under Article 12(5)(b) GDPR as "excessive" if the request's sole purpose is to verify the validity of premium increases instead of verifying the lawfulness of the processing of personal data. In its reasoning the OLG Hamm found that the term "in particular" in Article 12(5)(b) GDPR shows that there can also be other circumstances than the repetitiveness of a request which can render a request "excessive". The court further referred to Recital 63 and established that the purpose of the right to access is to be aware of, and verify, the lawfulness of the processing of personal data. Therefore, the Court considered a request whose sole purpose is to verify the validity of premium increases instead of verifying the lawfulness of the processing of personal data excessive
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 4 U 1905/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 4 U 1905/21 - Germany (2022). Retrieved from cookiefines.eu
Last updated: