Data Subject verus Finanzamt (FA) – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
In September 2019, the data subject submitted an access request to the controller, the German Tax Authority (Finanzamt – FA), under Article 15(1) GDPR and Article 15(3) GDPR. The controller responded by providing him with his personal data. The data subject deemed the information incomplete and repeated the request asking for copies of enforcement measures. In December 2019, the controller rejected the request for copies of enforcement related data with a formal decision, which did not include any information on legal remedies. On 25 February 2021, the data subject filed an action against the decision of the controller with the Fiscal Court (Finanzgericht Nürnberg), requesting that the controller be ordered to provide information on his personal data within the meaning of Article 15(1) and 15(3) GDPR and claiming that restrictions under national procedural rules conflicted with EU law. The Fiscal Court dismissed the action as inadmissible for exceeding the statutory time limit. The data subject appealed to the Federal Fiscal Court (Bundesfinanzhof – BFH), claiming that the GDPR does not set a deadline for bringing an action and could be brought at any time as in civil proceedings. He further claimed that no prior administrative proceedings were required since it is an action for performance. In any case the action for the provision of information pursuant to Article 15 GDPR may not be restricted by the requirements for bringing an action in the Fiscal Court Code (FGO). The Court dismissed the appeal and upheld the lower court’s finding that the claim was time-barred and procedurally inadmissible. It held that the response of a public body to an access request under Article 15 GDPR constitutes an administrative act. Therefore the action to compel a public body to provide a response is subject to the FGO. According to the FGO, when a data subject receives a negative decision from an administrative body with no legal remedy instruction provided, such as the rejec
GDPR Articles Cited
National Law Articles
In September 2019, the data subject submitted an access request to the controller, the German Tax Authority (Finanzamt – FA), under Article 15(1) GDPR and Article 15(3) GDPR. The controller responded by providing him with his personal data. The data subject deemed the information incomplete and repeated the request asking for copies of enforcement measures. In December 2019, the controller rejected the request for copies of enforcement related data with a formal decision, which did not include any information on legal remedies. On 25 February 2021, the data subject filed an action against the decision of the controller with the Fiscal Court (Finanzgericht Nürnberg), requesting that the controller be ordered to provide information on his personal data within the meaning of Article 15(1) and 15(3) GDPR and claiming that restrictions under national procedural rules conflicted with EU law. The Fiscal Court dismissed the action as inadmissible for exceeding the statutory time limit. The data subject appealed to the Federal Fiscal Court (Bundesfinanzhof – BFH), claiming that the GDPR does not set a deadline for bringing an action and could be brought at any time as in civil proceedings. He further claimed that no prior administrative proceedings were required since it is an action for performance. In any case the action for the provision of information pursuant to Article 15 GDPR may not be restricted by the requirements for bringing an action in the Fiscal Court Code (FGO). The Court dismissed the appeal and upheld the lower court’s finding that the claim was time-barred and procedurally inadmissible. It held that the response of a public body to an access request under Article 15 GDPR constitutes an administrative act. Therefore the action to compel a public body to provide a response is subject to the FGO. According to the FGO, when a data subject receives a negative decision from an administrative body with no legal remedy instruction provided, such as the rejec
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Data Subject verus Finanzamt (FA) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Data Subject verus Finanzamt (FA) - Germany (2025). Retrieved from cookiefines.eu
Last updated: