Court case 6 C 7.20 – Court Ruling (Germany, 2022)

The data subject was born in Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01 January 1956 and later corrected to 01 January 1958. When moving to Germany, which has been his country of residence ever since, in 1971, the data subject stated 01 January 1958 as his date of birth. This date was entered into the controller's register of residents. In 2015, his registered date of birth was changed to 01 January 1953 in Turkey after a decision of the District Court of Kayseri. Consequently, the data subject received a new Turkish passport stating this date of birth. When the data subject requested the controller to change his date of birth in its register accordingly, the controller refused due to a lack of certainty on his actual date of birth. The data subject pursued his request before the Administrative Court of Karlsruhe (Verwaltungsgericht Karlsruhe - VG Karlsruhe) where he was successful. The controller appealed against that decision and won before the Higher Administrative Court of Baden-Württemberg (Verwaltungsgerichtshof Baden-Württemberg - VGH Baden-Württemberg). Therefore, the data subject appealed the decision at the Federal Administrative Court. The Federal Administrative Court upheld the previous instance's decision, deciding that the data subject's request for rectification was unsuccessful. First, the Court agreed that the GDPR was applicable although the data subject's request had occurred before the GDPR's entry into force. Then, it confirmed the Administrative Court's application of Article 16 GDPR. The Administrative Court had correctly assumed that, while Article 16 GDPR was applicable, it could not be established that the data subject's birth date was indeed 01.01.1953. The Court confirmed that the right to rectification means the replacement of incorrect data with correct data. Consequently, there is no right to rectification if it cannot be established which data are correct. The Court disagreed with the Higher Administrative Court on the applicable law regarding the burden of proof but still came to the same conclusion that the data subject had to prove his actual date of birth. While the Administrative Court had applied national law of evidence, the Court clarified that Article 5(2) GDPR postulates a specific law of evidence based on the principle of accountability, making national law inapplicable. According to the Court, the burden of proof is generally upon the controller in the context of Article 16 GDPR because the controller has to prove that the data it holds are correct. However, this means in turn, that the controller cannot be required to enter and further process data whose accuracy cannot be established with sufficient certainty. In such a case, the controller would be in violation of Article 5(1)(d), (2) GDPR, which cannot be asked of him. Therefore, the the burden of proof regarding the accuracy of the data designated to replace the currently processed data lies on the data subject. Since the data subject could not prove his actual date of birth, the Court decided in favour of the controller.