Court case 25 K 2138/19 – Court Ruling (Germany, 2022)

In March 2019, the data subject requested rectification of his registered address from the controller, a municipality. According to him, he had lived at different addresses in the 1980s which did not show up in the record. The controller refused, arguing that it had no further data about the data subject and that the file had been archived already, meaning that it could not be edited anymore. In April 2019, the data subject brought an action against the controller in court. He argued that the controller had no good reason or legal basis to refuse the rectification. The controller claimed that the data subject had not proven that the data were inaccurate. Since the dates concerned were over 30 years in the past, it had no obligation to keep further documents or records since the retention periods had expired in the meantime. Furthermore, the data subject had violated his obligation to register every relocation which would have allowed a correct and seamless documentation of this information. The Administrative Court of Cologne (Verwaltungsgericht Köln - VG Köln) dismissed the data subject's claim. Initially, the court discussed whether the claim was inadmissible because it doubted that the data subject had a legitimate interest for legal relief in the first place. Such interest does not exist when the lawsuit can obviously not bring a plaintiff any legal or factual advantages. It criticised that the data subject had not substantiated why he had an interest in the rectification of data older than 30 years. It further agreed with the controller that it was partly the the data subject's own fault that the register was not up to date because he himself failed to comply with his obligations to re-register after each relocation. However, the court did not finally decide on the admissibility because it found the claim to be unsubstantiated anyhow. First, the court established that the only basis for the data subject's claim was Article 16 GDPR, as [https://www.gesetze-im-internet.de/bmg/__12.html § 12 Bundesmeldegesetz (BMG - Federal Registration Act)] clarifies. Then, it held that the legal requirements of Article 16 GDPR were not fulfilled. According to the court, Article 16 GDPR requires that the data processed by the controller are objectively incorrect, and, at the same time, the data designated to replace the inaccurate data must be factually correct itself. While the court did not rule out the possibility that the data held by the controller were inaccurate, it found that the data subject did not prove that the data provided by him was factually correct, because the documents submitted by him partly contradicted his previous statements. Since the burden of proof was on the data subject, the court dismissed his claim.