Court case 29 K 9469/23 – Court Ruling (Germany, 2026)

The data subject was subject to a home visit by the public health authority following an external report raising concerns about her condition. After the visit, the authority created internal medical notes and administrative records documenting observations made by a physician, as well as information about the person who had reported the situation. The data subject subsequently requested access under Article 15 GDPR to all records held about her, including call logs, internal reports, medical notes, and any documents containing her name. The authority provided a GDPR response and later disclosed the entire file, but redacted personal data relating to authority staff and the reporting third party. The data subject brought an action seeking full, unredacted disclosure, arguing that the records did not accurately reflect what had occurred during the home visit and that she was entitled to receive the documents in their entirety under the GDPR. The court dismissed the claim, holding that the controller had fully complied with its obligations under Article 15 GDPR. It emphasised that the right of access and the right to obtain a copy under Article 15(3) GDPR concern only the data subject’s own personal data, not the documents or files as such in which those data appear. Relying expressly on the CJEU’s judgment in C-487/21 (CRIF), the court recalled that the concept of a “copy” under Article 15(3) GDPR refers to a faithful reproduction of the personal data undergoing processing, not necessarily to a copy of the entire document containing them. The decisive criterion is whether the information provided enables the data subject to obtain a complete and accurate understanding of the personal data processed about them and to effectively exercise their GDPR rights, such as rectification, erasure, or restriction of processing. The court further clarified, in line with the CJEU’s reasoning, that the controller is entitled to redact information in the same document that does not relate to the data subject, including personal data of third parties. Such redactions are lawful provided that they do not distort or render unintelligible the data subject’s own personal data or the context in which those data are processed. The court thus found that the redactions made by the authority were permissible and did not undermine the substance of the access right, as the disclosed records still allowed the data subject to understand the purpose, context, and use of her personal data. Finally, the court stressed that Article 15 GDPR does not provide a mechanism to contest the factual accuracy or substantive correctness of administrative or medical assessments. Disagreements about the content of reports must be pursued through other legal remedies and cannot be resolved through the GDPR right of access.