Court case 6 U 114/23 – Court Ruling (Germany, 2024)

The plaintiff sued a private health insurance company (the controller) by way of an action by stages (Stufenklage) according to [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0945 § 254 German Civil Process Order (Zivilprozessordnung – ZPO)]. 57 clients of the controller had assigned claims to a third party (the plaintiff). The health insurance company had raised their insurance premiums. On the first stage, the claimant sued for information under Article 15 GDPR to be able to determine the premiums paid by the clients that had assigned their claims. On the second stage, the claimant sought a declaratory judgement that the raises of the insurance premiums by the controller were unlawful and were suing for an amount yet to be determined after having obtained the information from the first stage. The court of first instance, the Regional Court Wuppertal (Landgericht Wuppertal – LG Wuppertal) dismissed the lawsuit. = The court held that an action by stages was inadmissible because the claimant did not want to determine the exact amount of their claims but rather, if they had any claims at all. This made the claims brought forth on the second stage inadmissible because they were not specified enough under [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0934 § 253(2)(2) ZPO]. The claims for information on the first stage were however admissible. The admissible claims for information were, however, unfounded. This was due to the fact that the criteria of neither Article 15 GDPR nor other, national legal bases for the claims were matched. = The court held that Article 15 GDPR did not give right to information for two reasons: first, the right under Article 15 GDPR to obtain access to personal data is strictly personal and does not follow the assigned claim (as an exception to [https://www.gesetze-im-internet.de/bgb/__401.html § 401 German Civil Code (Bürgerliches Gesetzbuch – BGB)]). The court held that the right under Article 15 GDPR does neither follow assigned claims nor can it be transferred to others in itself, citing the German Federal Administrative Court [https://www.bverwg.de/160920U6C10.19.0 judgement 6 C 10/19]. The BVerwG had argued that the right under Article 15 GDPR was the elementary subjective data protection right and followed from [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%253A12012P%252FTXT Article 8(1) CFR]. The reason for this right was to facilitate the data subject’s right to data protection by providing the needed knowledge about the processing of their personal data. This right could not be executed by third parties without entirely changing its nature. The court referred to a [https://gesetze.berlin.de/bsbe/document/NJRE001572436 judgement of the Higher Regional Court Berlin (Kammergericht Berlin – KG Berlin)] which argued that it could be possible for the assignee to execute the assigning person’s Article 15 GDPR right through the power vested in the assignment (without transferring the Article 15 GDPR right itself). However, this at least had to be reflected in the claims made before the court. = Second, in this case, the court found that the exercise of the right under Article 15 GDPR amounted to an abuse of law. This followed from Article 12(5)(b) GDPR, because the wording included “in particular because of their repetitive character”, leaving room for other cases in which requests by data subjects could be manifestly unfounded or excessive. The court found that Member States had to refuse applying EU law whenever its norms are only used to achieve aims which do not fall within the aims of the respective legislation.