Court case 8 O 1280/21 – Court Ruling (Germany, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Regional Court of Erfurt in Germany asked the CJEU to clarify if people can use GDPR's data access rights for non-privacy reasons. This case could affect how companies respond to data requests. It's important for businesses to understand when they must provide data copies for free.
What happened
The Regional Court of Erfurt questioned if GDPR allows data access requests for non-privacy-related purposes.
Who was affected
An individual who requested access to his personal data from an insurance provider for non-privacy-related reasons.
What the authority found
The court sought clarification from the CJEU on whether GDPR's data access rights apply to requests not related to privacy concerns.
Why this matters
This case could clarify the scope of GDPR's data access rights, impacting how businesses handle such requests. Companies should stay informed about potential changes in legal interpretations.
GDPR Articles Cited
The data subject had lost his insurance certificates. He therefore sent an access request under Article 15(1) GDPR to the insurance provider (the controller) to obtain them. The Regional Court of Erfurt (LG Erfurt) held that the question of whether Article 15 GDPR may be used for non-data protection-related requests or whether it is an abuse of rights is controversial and the case law is not consistent on the matter. Therefore, it requested a preliminary ruling from the CJEU on the following questions: 1. Is Article 15(3) GDPR in conjunction with Article 12(5) GDPR to be interpreted to the effect that the controller is not obliged to provide the data subject a first copy of his personal data processed by the controller free of charge if the data subject does not request it for purposes referred to in the first sentence of recital 63 to the GDPR (namely to become aware of the processing of his personal data and to be able to check its lawfulness) but instead pursues another - non-data protection-related but legitimate - purpose? 2. If the answer to question 1 is no: a) Can a national provision of a Member State which was adopted before the entry into force of the GDPR be considered as a restriction on the right to a free copy of the personal data processed by the controller under Article 23(1) GDPR? b) If the answer to question 2a is in the affirmative: Is Article 23(1) GDPR to be interpreted as meaning that the rights and freedoms of other persons referred to therein also include their interest in being relieved of the costs associated with the provision of a copy of data pursuant to the first sentence of Article 15(3) GDPR and other expenses caused by the provision of the copy? c) If the answer to question 2b is affirmative: In the doctor-patient relationship, does the provision of a copy of the patient's personal data from the patient's file always and irrespective of the specific circumstances of the individual case give the doctor a right to charge the pati
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 8 O 1280/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 8 O 1280/21 - Germany (2022). Retrieved from cookiefines.eu
Last updated: