Court case 11 U 9/23 – Court Ruling (Germany, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a health insurer's premium calculation factor is not personal data under GDPR. This means the insurer didn't have to provide it to a customer who requested it. The decision clarifies what counts as personal data, affecting how companies handle similar requests.
What happened
The court decided that a health insurer's premium calculation factor is not personal data under GDPR.
Who was affected
A health insurance customer who requested access to premium calculation data.
What the authority found
The court ruled that the insurer's premium calculation factor is not personal data and thus not subject to GDPR access rights.
Why this matters
This ruling helps define what is considered personal data under GDPR, guiding companies on how to handle data access requests. It emphasizes that not all information related to a person is protected under GDPR.
GDPR Articles Cited
The plaintiff (data subject) objected to premium increases by the defendant, a private health insurer (controller). The data subject requested information regarding possible premium adjustments from 2012 in order to demonstrate that the premium increases were invalid. In particular, the data subject brought a claim for access to personal data under Article 15(1) GDPR, which related solely to the value of the triggering factor for the recalculation of the premium in the tariff at issue. The triggering factor is the percentage threshold by which the cost for insurance services or mortality probabilities must have changed in order for the insurer to be able to increase premiums for health insurance policies such as the one at stake.cf. § 203(2) Insurance Contract Act (Versicherungsvertragsgesetz - VVG) sentences 1 and 3 in conjunction with § 155(3) sentence 2 Insurance Supervision Act (Versicherungsaufsichtsgesetz - VAG) and § 155(4) sentence 2 VAG, respectively Muschner, in Langheid, Rixecker, Versicherungsvertragsgesetz, § 203 VVG margin number 23a (2017 Munich). The request for access was therefore aimed solely at being able to examine the legality of the premium increase. According to the data subject, the controller did not fully reply to the access request. After the Frankfurt (Oder) Regional Court dismissed the action as unfounded, the data subject appealed to the Brandenburg Higher Regional Court (OLG Brandenburg). (1) The court held that the value of the triggering factor for the recalculation of the insurance premium does not constitute personal data within the meaning of Article 4(1) GDPR as it is a mere calculation parameter without direct reference to the data subject, and hence does not fall within the material scope of the GDPR. (2) In an obiter dictum, the court also held that, even accepting the idea that the factors at issue constitute "personal data", the controller has a right of refusal under Article 12(5)(b) GDPR for abuse of the right of access
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 11 U 9/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 11 U 9/23 - Germany (2023). Retrieved from cookiefines.eu
Last updated: