Court case 12 U 305/21 – Court Ruling (Germany, 2022)

The defendant (and simultaneously controller) is a private company which provides health insurance services. The plaintiff (and data subject) is one of their costumers. Under the insurance agreement, the defendant could adjust the insurance premiums. At an unspecified time, the defendant decided to do so. In response, the plaintiff sought information from the defendant about the increased contributions. He requested information and documents regarding all contribution adjustments from January 1, 2011. The defendant refused the request. Subsequently, the plaintiff engaged in court proceedings. He argued that even though he had a statement of reasons, a document provided by the controller which outlined the reasons for the premium increases, he had lost the insurance certificates and accompanying documents from the years 2011 to 2020. This information would be necessary to calculate whether the increase of insurance premiums was legitimate. The plaintiff based his right to receive information, among other things, on Article 15 GDPR. The court of first instance decided to reject the claim and argued that Article 15 GDPR only provides data subjects with the right to have summaries of their processed personal data but not concrete documents, files or records. The data subject decided to appeal the court's decision. The court of appeal upheld the decision of the lower court by stating that the concerned access request cannot be supported by Article 15 GDPR. First, it pointed out that, according to Article 15 GDPR, controllers must provide a data subject with the personal data which is processed by them. The right of the data subject to receive information serves the purpose of becoming aware of the processing of the data and to check its lawfulness. Second, the court deemed the plaintiff's use of Article 15 GDPR an "abuse of rights". The court argued that the purpose of Article 15 GDPR was for data subjects to obtain an overview of the personal data processed by