Court case 20 U 146/22 – Court Ruling (Germany, 2023)

The data subject and the controller – an insurance company – litigated about the lawfulness of some premium adjustments in the data subject’s insurance policy. In this context, the data subject made an access request with the controller in order to obtain information on the basis of which the adjustments were triggered. The controller refused to comply with the data subject’s access request. The court of first instance aligned with the controller and declared the data subject’s action inadmissible. The Higher Regional Court of Hamm (Oberlandesgericht Hamm – OLG Hamm) upheld the court of first instance’s decision. The court did not exclude that in principle some of the information requested by the data subject were personal data within the meaning of Article 4(1) GDPR. Nevertheless, in this case the controller had the right to disregard the request in light of Article 12(5)(b) GDPR, as the latter was excessive. To ascertain whether an access request is excessive it is necessary, among others, to verify if the request pursues the goal of Article 15 GDPR, to be read in light of recital 63. In particular, an access request should enable a data subject to be aware of any processing operations concerning their personal data and check the lawfulness of said processing. In the present case, the data subject used instead the access request for a purpose which did not fall within the scope of data protection, namely to check whether premium adjustments were lawful under insurance law. The court stressed that this does not automatically entail that the data subject shall motivate their access request or distinguish between data protection purposes and other purposes. However, in cases where it is clear that the only purpose of the request is not related to data protection, the controller has a right to refuse to comply with the request. Finally, the court acknowledged that the issue could be the object of a preliminary reference to the CJEU. However, being the OLG Hamm not a court of last instance, such a preliminary reference is not mandatory pursuant to Article 267 TFEU. In light of the above, the court rejected the data subject’s claim.