Court case 5 O 1954/21 – Court Ruling (Germany, 2022)

An insurance policy holder (the claimant) had a private health insurance with an insurer (the defendant). After the defendant made certain premium adjustments within the framework of the existing health insurance contract, the claimant initially unsuccessfully requested information on premium adjustments from the defendant. The claimant then asserted that he had the right of access to information from the defendant under Article 15 GDPR concerning the years 2018, 2019, and 2020 to the effect that the defendant had to inform him of the amount of the respective premium adjustments and the information transmitted for this purpose in the form of insurance certificates. The Regional Court Kassel (LG Kassel) first considered if the amount of a health insurance premiums constituted personal data. It held that it could not be regarded as personal data as it does not reflect the individualized insurance protection of the insured persons, taking into account their health conditions. It merely provides information on the price of the insurance cover for a particular person as laid down in the insurance contract. Even though there are individual tariffs for the premium amounts, it does not enable the identification of an individual. Therefore, the amount a person spends on their health insurance cannot be regarded as personal data. Consequently, the claimant had no right to access under Article 15 GDPR. Second, the Court considered whether the claimant could have invoked their Article 15 GDPR rights if the data in question had been personal data. It held that, in light of Recital 63 GDPR, the intent and purpose of the right of access is to make the data subject aware of the processing of personal data and enable them to verify the lawfulness of data processing. The claimant, however, invoked Article 15 GDPR exclusively to examine and check the premium adjustments made by the defendant for possible mistakes which the protective purpose of the GDPR does not cover. Consequently, the Court held that such use of Article 15 GDPR would amount to an abuse of rights and hence is not allowed.