Court case 4 C 1845/21 – Court Ruling (Germany, 2022)

The controller is an architect, building biologist, energy consultant and real estate expert. In 2020, the controller prepared an expert opinion on the value of a property on behalf of the data subject's former wife in the context of a family law dispute. The data subject who had not given prior consent was made identifiable in the expert opinion as the owner of the property by stating his full name. In 2021, the data subject sent an access request to the controller, to which the latter replied without attaching the expert opinion as such to the letter. With several more letters, the data subject claimed damages while calling the controller names and threatening exposure to the Architects' Chamber and the Data Protection Authority. With further letters, he targeted the controller's lawyer. Before the court, the data subject claimed that the information provided was incomplete because it lacked the expert opinion as such. He argued that data relating to any third persons could simply be redacted in the document. The controller claimed that the requested information was not included in the right to access and that any further information would infringe other parties' rights. In any case, the request was unfounded and excessive. The District Court of Pforzheim managed the case. The court dismissed the data subject's claim, agreeing with the controller. First, it held that the data subject's right to access had been fulfilled by the controller. According to the court, the scope of information owed under Article 15 GDPR is dependent on the controller's intention. Once the controller has given the information in accordance with what they believe constitutes the entirety of the data processed, the suspicion that the information provided is incomplete or incorrect cannot justify a claim to information to a greater extent. Essential for the fulfillment of the right to information is therefore the - possibly implied - declaration by the controller that the information is complete. Furthermore, the data subject had not demanded a copy of the expert opinion or the file in his access request. Since the controller had expressed his intention of fulfilling the access request by stating that other data of the data subject had not been processed, the court concluded that there was no valid claim to further information. The court left the question of whether the data subject could demand a copy of the data or whether third parties' rights could be respected by redactions unanswered. Instead, it held that, in any case, the access request had been manifestly unfounded and excessive in the sense of Article 12(5) GDPR. According to the court, it was clear from the overall context that the data subject was primarily using the right to information under Article 12 GDPR to harass the controller and his legal representatives by threats and insults.