Court case 8 U 165/22 – Court Ruling (Germany, 2022)

The case concerned, among other things, a data subject's Article 15 GDPR access request to acquire supplementary information about their increased insurance premiums from their private health insurance provider. The health insurance provider was the concerned controller in this case. As, at the time being, had often been the case in Germany, the court of first instance (in this case, the Regional Court Stade), had held that the access request was "excessive" since, contrary to Recital 63 GDPR, the request did not serve to further data protection related matters. Therefore, the lower court had had decided that the controller had a right to refuse the request under Article 12(5)(b) GDPR. The data subject appealed the decision. OLG Celle, a court of second instance, overturned the decision of the lower court in respect to its holding on the excessiveness of the data subject's access request. Contrary to the Regional Court of Stade, OLG Celle argued that Recital 63 GDPR - which states that the purpose of the right to access is to make data subjects aware of the processing of their personal data and to give them the possibility to verify the lawfulness of the processing - only mandates that the requested information concerns personal data in the sense of Article 4(1) GDPR. Moreover, OLG Celle also held that a singular access request can never be excessive for the purposes of Article 12(5) GDPR as the GDPR only described the case of frequent repetition as a standard example for the assumption of an excessive application. Moreover, OLG Celle stated that the GDPR does not have any requirements which data subjects have to meet to justify their access requests. "The motivation of the plaintiff is irrelevant because the regulation does not make the right to information dependent on a specific objective of the claimant and accordingly the access request does not have to be substantiated", so the court. Consequently, OLG Celle overturned the decision in this respect.