- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case 11 U 9/23 – Court Ruling (Germany, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a private health insurer did not have to provide access to certain premium calculation data. The court found that the data requested did not qualify as personal data under GDPR. This decision clarifies what constitutes personal data in access requests.
What happened
The private health insurer refused to provide access to premium calculation data requested by a user.
Who was affected
A user who sought information regarding premium adjustments from their health insurer.
What the authority found
The court held that the requested premium calculation data did not constitute personal data and therefore was not subject to access under GDPR.
Why this matters
This ruling clarifies the definition of personal data in access requests. It serves as a reminder for users and companies to understand the limits of data access rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The plaintiff (data subject) objected to premium increases by the defendant, a private health insurer (controller). The data subject requested information regarding possible premium adjustments from 2012 in order to demonstrate that the premium increases were invalid. In particular, the data subject brought a claim for access to personal data under Article 15(1) GDPR, which related solely to the value of the triggering factor for the recalculation of the premium in the tariff at issue. The triggering factor is the percentage threshold by which the cost for insurance services or mortality probabilities must have changed in order for the insurer to be able to increase premiums for health insurance policies such as the one at stake.cf. § 203(2) Insurance Contract Act (Versicherungsvertragsgesetz - VVG) sentences 1 and 3 in conjunction with § 155(3) sentence 2 Insurance Supervision Act (Versicherungsaufsichtsgesetz - VAG) and § 155(4) sentence 2 VAG, respectively Muschner, in Langheid, Rixecker, Versicherungsvertragsgesetz, § 203 VVG margin number 23a (2017 Munich). The request for access was therefore aimed solely at being able to examine the legality of the premium increase. According to the data subject, the controller did not fully reply to the access request. After the Frankfurt (Oder) Regional Court dismissed the action as unfounded, the data subject appealed to the Brandenburg Higher Regional Court (OLG Brandenburg). (1) The court held that the value of the triggering factor for the recalculation of the insurance premium does not constitute personal data within the meaning of Article 4(1) GDPR as it is a mere calculation parameter without direct reference to the data subject, and hence does not fall within the material scope of the GDPR. (2) In an obiter dictum, the court also held that, even accepting the idea that the factors at issue constitute "personal data", the controller has a right of refusal under Article 12(5)(b) GDPR for abuse of the right of access
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 11 U 9/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
16 June 2023
Authority
DPA LGFrankfurt
About this data
Cite as: Cookie Fines. Court case 11 U 9/23 - Germany (2023). Retrieved from cookiefines.eu
Last updated: