In its ruling of March 5, 2024 (VI ZR 330/21), the Federal Court of Justice ("BGH") further clarified the scope of the right of access in yet another decision. In particular, it has provided more clarity as to what is meant by the right to a copy of personal data. According to the decision of the Federal Court of Justice, letters from the data subject to the controller are to be classified as personal data in their entirety and must therefore be transmitted in full as part of a request for information. However, letters from the controller to the data subject (as well as telephone notes, file notes, minutes, e-mails, letters and subscription documents for investments, etc.) are not necessarily personal data in their entirety. There is an obligation to provide such documents within the scope of information to the extent that these letters contain information about the data subject and it is necessary for the contextualization of the processing and the effective exercise of the data subject's rights to provide these documents in full or in excerpts.
Facts of the case
The decision was based on an action brought by an investor against her long-standing financial advisor for the provision of copies. The data subject requested that she be provided with copies of all personal data of the data subject held by the controller in accordance with Art. 15 para. 3 GDPR, in particular in the form of telephone notes, file notes, minutes, e-mails, letters and subscription documents for investments.
The legal dispute went through several instances up to the BGH.
Decision of the BGH
The BGH ruled that the claim for disclosure of these documents was justified with regard to the e-mails and letters sent to the controller. In this case, however, this did not apply to letters from the controller to the data subject, telephone notes, file notes, minutes of conversations, etc.
The BGH justifies this distinction as follows:
According to the principles established by the European Court of Justice ("ECJ") in previous decisions (especially C-487/21 and C-307/22), the right to a copy pursuant to Art. 15 (3) GDPR determines the practical modalities of access pursuant to Art. 15 (1) GDPR, but does not confer an independent right. The term "copy" in Art. 15 (3) GDPR does not refer to a document as such, but to the personal data it contains (see also Update Data Protection No. 147). The copy must contain all personal data that is the subject of the processing. From this, the BGH concludes that true copies of personal data must be provided.
Furthermore, the BGH states that the concept of personal data is to be interpreted broadly according to the case law of the ECJ, so that not only sensitive or private information is to be understood as such. Rather, all types of information of both an objective and subjective nature are included, whereby the information must be linked to a specific person due to its content, purpose or effects.
With regard to copies of letters from a data subject to the controller, the BGH concludes that the entire content of these letters must be classified as personal data. The personal information already consists of the fact that the data subject has made a statement in accordance with the letter.
According to the BGH, this means that letters from the data subject to the controller must be transmitted in their entirety as part of a disclosure. The BGH expressly emphasizes that in such cases, the information is only complete if a copy of the entire document is provided. The fact that the letters are already known to the person does not exclude the data subject's right to information.
Conversely, according to the BGH, letters from the controller to the data subject are only to be classified as personal data insofar as they contain information about the data subject. However, such letters do not necessarily constitute personal data in their entirety. The same applies to telephone notes, file notes, minutes, etc. of the controller. In the present case, the BGH did not consider the obligation to provide complete information about personal data to give rise to a claim to provide a copy of these documents in their entirety. According to the BGH, this also does not follow from the principles established by the ECJ in this regard. The latter had ruled that excerpts from documents or entire documents or even excerpts from databases containing personal data must also be transmitted if this is necessary to "contextualize" the processed data, i.e. transmission is necessary to ensure the comprehensibility of the processing and to guarantee the data subject the effective exercise of their rights. The Federal Court of Justice expressly refers to this case as an exception (see "exceptionally" para. 18).
The BGH subsumed this by stating that this had not been demonstrated by the data subject in the present case or "was not otherwise the case".
Consequences of the decision
The BGH decision is particularly interesting from a practical perspective. When it comes to the disclosure of documents, it is always important to take a close look:
Letters and emails sent by a data subject to the controller are personal data in their entirety and must therefore be disclosed in their entirety in accordance with Art. 15 para. 3 GDPR. The argument that the data subject is already aware of these documents because they have written them themselves does not hold water. At first glance, the Higher Regional Court of Düsseldorf took a different view in a decision from 2023 (case no. 13.7.2023 - I-13 U 102/22, I-13 U 44/23) - albeit in a special constellation. The Higher Regional Court of Düsseldorf had ruled on a claim for the surrender of copies by a policyholder against his insurance company that the transmission of insurance documents to the data subject (policyholder) is not necessary for contextualization within the framework of Art. 15 para. 3 GDPR if these have already been made available once and the data subject cannot plausibly show that he no longer has them. However, the BGH deliberately accepted in this decision that letters and emails may often still be known to the data subject themselves. In particular, it referred to an earlier decision in which it had already ruled that the right of access under Art. 15 GDPR is not limited to data that is not yet known to the data subject.
Conversely, the obligation to transmit entire documents does not necessarily apply to letters to the data subject, etc. These documents may in turn contain personal data that must be faithfully reproduced in accordance with Art. 15 para. 3 GDPR. However, the BGH expressly declares the obligation to transmit entire documents or excerpts thereof in this context as an exception. It is also noteworthy that the BGH apparently sees the data subject as having the burden of proof to demonstrate why such an exception exists. It will be interesting to see how this develops in practice.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.