Court case 20 U 295/21 – Court Ruling (Germany, 2022)

The data subject has a health insurance contract with the controller. The controller increased the premiums during the contract. The data subject payed the increased premiums for a while but then filed a lawsuit against the controller demanding a refund as well as access to all supplements to the insurance policy and all notification letters sent to him during the contractual relationship under Article 15 GDPR. The court of first instance, the Regional Court of Aachen (Landgericht Aachen – LG Aachen), ruled in favour of the data subject. The controller appealed this decision arguing that the right to access under Article 15 GDPR does not grant a right to access to documents but its only purpose is to make the processed data transparent. Moreover, it argued that granting the access to such a wide extent would amount to an inadmissible discovery of evidence which is contrary to the civil procedural principle that each party must bring forward its evidence itself. Lastly, the controller also invoked the excessiveness of the request under Article 12(5) GDPR alleging that the data subject uses Article 15 GDPR only to verify the validity of the premium increases and not to verify the lawfulness of the processing. The Higher Regional Court of Köln (Oberlandesgericht Köln – OLG Köln) rejected the arguments of the controller and upheld the lower court’s judgement. First, the court referred to case law by the German Supreme Court (Bundesgerichtshof – BGH decision from 15.06.2021, case no. VI ZR 576/19) to establish that personal data under Article 4(1) GDPR means information which by virtue of its content, purpose or effects, is linked to a specific person. The court then concluded that the supplements to the insurance policy as well as the notification letters meet these requirements. For the supplements the court found that they show the content and conditions of the insurance cover provided to the data subject by the controller. Regarding the notification letters the court reasoned that they are also sufficiently linked to the data subject because they inform the respective policyholder of a change in his insurance contract on a certain date. Second, the court found that the right to a copy under Article 15(3) GDPR is independent from the right to access under Article 15(1) GDPR and is to be construed extensively. Consequently, the court held that Article 15(3) GDPR gives the data subject a right to a copy of the data in its raw form. Third, the court rejected the arguments of the controller. It concluded that the controller was neither under [https://www.gesetze-im-internet.de/bgb/__242.html § 242 BGB (German Civil Code)] nor under Article 12(5) GDPR allowed to reject the request as excessive. It also rejected to limit the scope of Article 15(3) GDPR teleologically, only because the request was aimed at verifying the lawfulness of premium increases and not at verifying the lawfulness of the data processing. It reasoned that the overall purpose of the GDPR is to protect all rights and freedoms of the individual against harm and risks arising from the processing of personal data, and not only the rights and freedoms enshrined in data protection law. Therefore, the court concluded that the data subject pursues a recognizable legitimate interest when using Article 15(3) GDPR to reduce an asymmetric level of information between himself and the controller in order to protect his rights. Moreover, the court found that there is no way to verify that the data subject is indeed only interested in the copy of his data to check the validity of the premium increases and is not also concerned about the protection of his data. Consequently, the court noted that it is unreasonable to make the right to access dependent on an unverifiable assertion about the inner motivation of a data subject. The court also rejected the controller's argument that granting the access would amount to an inadmissible discovery of evidence, because the inadmissibility of discovery is a procedural concept which cannot be transferred to a material claim such as Article 15 GDPR. Lastly, the court allowed the appeal to the Federal Court of Justice ([https://www.bundesgerichtshof.de/EN/Home/homeBGH_node.html Bundesgerichtshof] - BGH), Germany’s highest court of civil and criminal jurisdiction, because of the fundamental importance of the legal matter and the inconsistency of case law on this matter [see Comment section].