S-Bahn Berlin – Court Ruling (Germany, 2023)

The controller in this case is the operator of the Berlin S-Bahn train network. Its trains are provided with CCTV cameras and the recorded data is saved for 48 hours and then automatically deleted unless requested by law enforcement authorities. A data subject visited a train of the controller on 6 October 2020 and on the same day sent an e-mail to the controller requesting access to the CCTV recordings of the train she was on and asked not to automatically delete the recordings after 48 hours. The controller refused to do so since, it claimed, it can only provide such data to law enforcement authorities. The data subject then complained to the Berlin DPA (Berliner Beauftragte für Datenschutz und Informationsfreiheit - BlnBDI), which issued a reprimand against the controller for violating the right to access of the data subject under Article 15 GDPR. Following the decision, the controller, hereinafter the plaintiff, appealed the decision by the Berlin DPA, as a defendant, before the Berlin Administrative Court (Verwaltungsgericht Berlin - VG Berlin). In its appeal, the plaintiff claimed, among others, first, that its video recordings do not constitute personal data under the GDPR as the individuals are not identifiable; secondly, that even if they were to be considered identifiable perosnal data, the effort to fulfill such requests is disproportionately high making also reference to Article 11(1) GDPR, which states that controllers are not required to process further information in order to comply with an access request. Through this legal action, the plaintiff sought the annulment of the reprimand and a court ruling stating that it is not obliged, in any case, to retain CCTV recordings for more than 48 hours and make them available to data subjects requesting access. The Berlin VG ruled, first of all that the plaintiff was not obliged to provide the data subject with the CCTV video recorings in question. The court recognised that the data included therein doe