Court case 29 K 9469/23 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a public health authority properly handled a request for access to personal data after a home visit. The authority provided relevant records but redacted information about its staff and the person who reported the situation. This decision clarifies that individuals can access their own data, but not necessarily every document that contains it.
What happened
A person requested full access to records from a public health authority, which included redacted information about staff and a reporter.
Who was affected
The individual who was subject to the home visit and sought access to the records created by the public health authority.
What the authority found
The court found that the authority complied with its obligations under Article 15 of GDPR by providing access to the individual's personal data while redacting unrelated information.
Why this matters
This ruling reinforces that individuals have the right to access their own data but not necessarily every document containing that data. It serves as a reminder for organizations to balance transparency with privacy.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The data subject was subject to a home visit by the public health authority following an external report raising concerns about her condition. After the visit, the authority created internal medical notes and administrative records documenting observations made by a physician, as well as information about the person who had reported the situation. The data subject subsequently requested access under Article 15 GDPR to all records held about her, including call logs, internal reports, medical notes, and any documents containing her name. The authority provided a GDPR response and later disclosed the entire file, but redacted personal data relating to authority staff and the reporting third party. The data subject brought an action seeking full, unredacted disclosure, arguing that the records did not accurately reflect what had occurred during the home visit and that she was entitled to receive the documents in their entirety under the GDPR. The court dismissed the claim, holding that the controller had fully complied with its obligations under Article 15 GDPR. It emphasised that the right of access and the right to obtain a copy under Article 15(3) GDPR concern only the data subject’s own personal data, not the documents or files as such in which those data appear. Relying expressly on the CJEU’s judgment in C-487/21 (CRIF), the court recalled that the concept of a “copy” under Article 15(3) GDPR refers to a faithful reproduction of the personal data undergoing processing, not necessarily to a copy of the entire document containing them. The decisive criterion is whether the information provided enables the data subject to obtain a complete and accurate understanding of the personal data processed about them and to effectively exercise their GDPR rights, such as rectification, erasure, or restriction of processing. The court further clarified, in line with the CJEU’s reasoning, that the controller is entitled to redact information in the same document that does not
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 29 K 9469/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 29 K 9469/23 - Germany (2026). Retrieved from cookiefines.eu
Last updated: