Court case 2 O 186/22 – Court Ruling (Germany, 2022)

The data subject contracted a private health insurance with the controller. The controller informed the data subject that their insurance premiums would increase. The data subject received the corresponding insurance certificates from the controller. Subsequently, the data subject unsuccessfully requested additional supplementary information about the increase of premiums. Consequently, the data subject decided to sue to controller, arguing that the controller is obliged to give them access to the supplementary information pursuant to Article 15 GDPR. Additionally, the data subject referred to other court proceedings which held invalid comparable premium increases from the same insurance company, to clarify the reasons for their claim for supplementary information. The court dismissed the claim based on Article 15 GDPR. It held that the access request constituted an abuse of rights (Section 242 of the German Civil Code). According to this principle, an exercise of a right is not permitted if, among other things, the claimant takes advantage of a formal legal position or asserts something in which he or she has no self-interest worth protecting. According to the intention of the data subject, the requested information is to serve exclusively the pursuit of benefit claims. This is a purpose completely unrelated to the purpose of Article 15 GDPR. According to recital 63 of the GDPR, the right of access under Article 15 GDPR serves the data subject to be aware of the processing of their personal data and to be able to check its lawfulness. Thus, Article 15 GDPR is intended to enable a lawfulness check on data processing operations. The data subject should be able to assess the scope and content of the stored data. Moreover, the information received through Article 15 GDPR also serves to enable the data subject to exercise further rights under the GDPR, in particular the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, and the right to restriction of processing under Article 18 GDPR. The court therefore rejected the claim of the data subject as the they had no relevant data protection interests: "not even as a reflex".