Court case VI ZR 223/21 – Court Ruling (Germany, 2024)

In April 2019, following Article 15 GDPR, the data subject requested access to his personal data from an insurance company related to a terminated pension insurance contract that was initiated in 2004 and settled by 2017. The information included transcripts of statements and copies of data from the contract in order to be able to examine a possible right of withdrawal. The controller provided the personal data it had stored (name, address, date of birth, email address, bank details, nationality, marital status, health data) and financial details like the total contributions paid, but the data subject considered it was insufficient, particularly regarding specific data and documentation related to the insurance dealings. The data subject requested the following data: # the statements made by the controller to the data subject (letters of termination, statements and enquiries regarding the contract, statements regarding the state of health); # the statements made by the controller to the data subject or to third parties (insurance certificate with supplements, cover letters, termination letters, payment reminders, settlement letters, notifications about the status of the contract); # accounting data for each incoming and outgoing payment stored in relation to the data subject's insurance contract; and # the fund profits achieved, the amount of the administration, distribution and acquisition costs deducted from the data subject's insurance premium, the capital at risk, the probability of loss occurrence and/or the actual value of the risk protection. In 2020, the Regional Court of Stuttgart (Landgericht Stuttgart - LG Stuttgart) dismissed the claim because there was no entitlement to further information than that already provided. In 2021, upon appeal by the data subject, the Higher Regional Court of Stuttgart (Oberlandesgerichts Stuttgart - OLG Stuttgart) partially amended the Regional Court’s judgment and ordered the controller to provide the data subject with information about statements and transactions, and awarded partial reimbursement for the data subject legal costs. The case was then appealed to the Appeal Court with regard to the rejected claim for transcripts and copies. The data subject is pursuing his request to the extent of the appeal being dismissed, with the proviso that with regard to the request for information under item "4" (fund profits achieved, etc.), the data subject is now requesting the transmission of copies of the more precisely specified data directly, i.e. not as previously by way of a staged action. In the alternative, the data subject has applied in the Appeal instance for copies of the personal data contained in the documents to be sent to him. The German Federal Court of Justice (Bundesgerichtshof – BGH) held that the data subject is entitled to request additional information under Article 15(1) GDPR, specifically copies of statements he made to the controller. However, the court limited this right to personal data, excluding internal processes of the controller that do not directly concern the data subject, such as internal financial calculations and risk assessments which were deemed not to be personal data. Furthermore, the Court found that the data subject does not have rights to the more detailed data he sought referred to fund profits and risk assessments, as these do not constitute personal data under GDPR. BGH also clarified that the right to a copy under Article 15(3) GDPR does not extend beyond the scope of Article 15(1), meaning the data subject is only entitled to copies of his personal data, not other documents or data beyond this. The decision also stated that the data subject's claims for copies of data do not arise from Section 3 of the Insurance Contracts Act (VVG), as the insurance relationship had been fully terminated and settled. As such, these rights no longer apply. The Court also found that the Regional Court incorrectly denied the data subject's right to receive copies of statements made by the controller and booking data related to the data subject's contract and transactions, these should be reassessed and was referred back to the Appeal Court for a new hearing and decision.