Court case I ZR 115/25 – Court Ruling (Germany, 2025)

Court Ruling
DPA OLGDresden18 December 2025Germany
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

The data subject had private health and long-term care insurance with the controller since 2010. Over the years, the controller adjusted the monthly insurance premiums several times, and informed the data subject of these adjustments through policy supplements and standardised explanatory letters, which the data subject no longer possessed. In March 2023, the data subject requested that the controller provide copies of the documents relating to past premium adjustments. After the controller refused, the data subject brought an action seeking access under Article 15(1) and (3) GDPR. Specifically, the data subject requested information concerning the contribution history of the insurance contract, including the dates and amounts of old and new premiums, tariff changes, and tariff terminations for several years. The court of first instance dismissed the claim. On appeal, the appellate court partially upheld the data subject’s request, holding that the requested information constituted personal data and therefore fell within the scope of Article 15 GDPR. The controller appealed to the Federal Court of Justice. The controller argued that the requested information did not constitute personal data because premium adjustments and tariff information were determined on an abstract, tariff-based basis and were not linked to the individual data subject. It further argued that the data subject’s request constituted an abuse of rights, as it was intended to prepare a repayment claim rather than to exercise data protection rights. The Court upheld the appeal, set aside the appellate judgment, and referred the case back for a new decision. The Court confirmed that Article 15 GDPR applies irrespective of the data subject’s motivation and that a request for access cannot be refused merely because it serves purposes unrelated to data protection. It also rejected the controller’s argument that the request constituted an abuse of rights under Article 12(5) GDPR. However, the Court hel

GDPR Articles Cited

Art. 15 GDPR
Art. 12(5) GDPR
Art. 15(1) GDPR
Art. 15(3) GDPR
Decision AuthorityBGH
Reviewed AuthorityOLG Dresden
Full Legal Summary

The data subject had private health and long-term care insurance with the controller since 2010. Over the years, the controller adjusted the monthly insurance premiums several times, and informed the data subject of these adjustments through policy supplements and standardised explanatory letters, which the data subject no longer possessed. In March 2023, the data subject requested that the controller provide copies of the documents relating to past premium adjustments. After the controller refused, the data subject brought an action seeking access under Article 15(1) and (3) GDPR. Specifically, the data subject requested information concerning the contribution history of the insurance contract, including the dates and amounts of old and new premiums, tariff changes, and tariff terminations for several years. The court of first instance dismissed the claim. On appeal, the appellate court partially upheld the data subject’s request, holding that the requested information constituted personal data and therefore fell within the scope of Article 15 GDPR. The controller appealed to the Federal Court of Justice. The controller argued that the requested information did not constitute personal data because premium adjustments and tariff information were determined on an abstract, tariff-based basis and were not linked to the individual data subject. It further argued that the data subject’s request constituted an abuse of rights, as it was intended to prepare a repayment claim rather than to exercise data protection rights. The Court upheld the appeal, set aside the appellate judgment, and referred the case back for a new decision. The Court confirmed that Article 15 GDPR applies irrespective of the data subject’s motivation and that a request for access cannot be refused merely because it serves purposes unrelated to data protection. It also rejected the controller’s argument that the request constituted an abuse of rights under Article 12(5) GDPR. However, the Court hel

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Court case I ZR 115/25 in DE

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

18 December 2025

Authority

DPA OLGDresden

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Court case I ZR 115/25 - Germany (2025). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: