Court case 31 C 2043/22 (78) – Court Ruling (Germany, 2023)

After failing a language test, a data subject requested the test provider (controller) to provide her a copy of her examination paper under Article 15(3) GDPR. The controller offered the data subject to consult her paper at its office but refused to provide a copy. It argued that the majority of the paper did not contain personal data under the meaning of Article 4 GDPR and that it had an interest in secrecy that justified its refusal to provide a copy under Article 15(4) GDPR. Unsatisfied, the data subject brought an action with the Amstgericht Frankfurt (local Court of Frankfurt). First, the Court did not follow the controller's argument concerning the non-personal nature of the data included in the paper. Indeed, the answers of the data subjects and the comments of the examiner constituted personal data under Article 4 GDPR. The test questions however were not personal data. Second, the Court weighed up the right of the data subject to obtain a copy and the interest of the controller in secrecy under Article 15(4) GDPR. It considered that the test questions constituted trade secrets within the meaning of national provisions and that the development of these language test represented a complex procedure involving considerable economic effort. These tests are used in naturalization procedure and due to a lack of secrecy, there could be a risk that the examination would no longer be considered sufficient to determine language skills for this purpose. As a result, the entrepreneurial freedom of the controller could be threatened. The Court therefore considered that on the basis of its interest to secrecy, the controller could refuse to provide a copy under Article 15(4) GDPR. It also took into account that the right to access was not entirely denied since the data subject could consult her paper at the controller’s office.