Court case 4 U 347/21 – Court Ruling (Germany, 2023)

A data subject requested a copy of the personal data about him being stored by his former employer under Article 15(1) and (3) GDPR. The data subject believed that the response by his former employer, the controller, was incomplete and filed suit with the Regional Court of Nürnberg-Fürth. On 29 January 2021, the court dismissed the claim. Unsatisfied with the decision of the court, the data subject filed an appeal with the Higher Regional Court of Nürnberg (Oberlandesgericht Nürnberg, OLG Nürnberg), claiming again that his right to access to all personal data about him saved by the controller. The data subject, as former employee and board member of the controller requested access to personal data about him from January 2000 until September 2016, including, among others, correspondence, calendar appointments, offsetting of company shares and other information related to his role as board member. The OLG Nürnberg held first of all, that the appeal was admissible. Then, the court considered that the access request was sufficiently clear, as it basically reflected the wording of Article 15(1) GDPR and that it is generally not necessary for access requests to specify the data requested. Then, the court also considered that personal data about a data subject cover all information that is connected to that person, because of its content, purpose or effects. Further, making reference to C-307/22, the court clarified that the right to access under Article 15 GDPR is “without prerequisites”, meaning that a controller should grant access to personal data that is needed also for purposes other than those included in Recital 63 GDPR. Moreover, the court held that the access request cannot be considered an abuse of the data subject’s rights, since the right to data protection is a fundamental right and having access to one’s personal data is a way of protecting such right. The fact that, because of the long term of employment of the data subject, the personal data about hi