Right of access by the data subject

Control of personal data

The General Data Protection Regulation (GDPR) grants the persons concerned a number of rights so that they can exercise control over the Processing of their personal data and thus over their personal rights protected by fundamental rights. These rights are commonly referred to as the "eight fundamental rights of the data subject" and include the following rights:

• The right to Correction (Article 16)
• The right to Deletion (Article 17)
• The right to restrict the Processing (Article 18),
•  The right to information (Article 19)
• The Right to Data Portability (Article 20)
• The right to object (Article 21),
• The right not to be subject to an automated processing Processing based decision (Article 22)
• The right of access (Article 15).

The right of access is not an unknown right. Directive 95/46/EC and the data protection laws of the EU Member States provided for the affected person already has the opportunity to Right to information to be able to exercise this right (see: Art. 12 of Directive 95/46/EC; § 19 of the former BDSG; Art. 35(1) of the French Data Protection Act). However, data subjects have only become more aware of this right since the General Data Protection Regulation (GDPR) came into effect and gained widespread recognition.

Right to information: What is it about?

The Right to information is enshrined in Art. 15 GDPR. It gives data subjects two rights if the relevant requirements are met. On the one hand Affected parties on request to the person responsible for the Processing responsible persons receive confirmation as to whether personal data whether or not personal data relating to the data subject is being processed (right to confirmation). If this is the case, data subjects also have the right to receive a copy of the personal data currently being processed by the controller (right to receive a copy).

In addition, the Board of Processing Responsible persons provide the data subjects with additional information, e.g. about the purposes of the Processing (Art. 15 para. 1 lit. a GDPR), the recipients of the personal data concerned (Art. 15 para. 1 lit. c GDPR) or the retention period for personal data (Art. 15 para. 1 lit. d GDPR). If a affected Person her Right to information then the Responsible persons comply with the request without undue delay and in any event within one month of receipt of the request, in accordance with Art. 12 (3) of the GDPR. In view of the complexity of the request, the person responsible for the Processing Responsible persons but extend the deadline by two additional months (Article 12(3) of the GDPR).

It should be noted that the Right to information is a highly personal right granted to the persons concerned. As an inalienable and non-transferable right, it can therefore only be exercised by the data subject and not by a third party. It is limited exclusively to the personal data that is processed via the affected The personal data of other persons is therefore generally irrelevant.

The right to information: a far-reaching right?

According to Recital 63 of the GDPR, the Right to information enable the persons concerned to face up to the Processing of their own data and to become aware of their legitimate Processing by the person responsible.

The European Court of Justice (ECJ) reinforces this in its remarks on the right of access, since, in its view, other rights derive directly from the Right to information because it is necessary "to enable the data subject, where appropriate, to be informed of the Processing Responsible for the Correction, Deletion or blocking of their data [...] ". However, the question of the scope of this right and which personal data is covered by this right remains unanswered.

Pursuant to Art. 4 (1) of the GDPR are personal data Any information relating to an identified or identifiable individual. This includes personal data such as a name, date of birth, email address, or other characteristics that could make it possible to identify a person, such as an account number, phone number, or Social Security number. This also includes sensitive data such as information about the data subject’s health (e.g., diagnoses, test results, details of treatments, etc.). In a decision by the Cologne Regional Court dated June 19, 2019, the court, after Right to information had recognized it as a comprehensive right, but decided to limit its scope by holding that the Right to information " to all internal transactions of the defendant, such as memoranda, or to the fact that the person concerned may have all correspondence already known to the person concerned reprinted and sent to him. ", and by pointing out that the purpose of this right is to protect the affected to enable the person to assess the scope and content of the personal data stored and not to help them simplify their accounting.

In a ruling dated June 15, 2021, the court followed the Federal Constitutional Court However, it did not follow the approach of the Cologne Regional Court and, after noting that the concept of personal data should be interpreted broadly, held that the Right to information "potentially include all types of information, both objective and subjective, in the form of opinions or assessments", "provided that it is information about the person in question. In order to assess whether information relates to a affected person, it is sufficient if the information is linked to a specific person due to its content, purpose or effect".

However, the broad interpretation of the scope of the right of access is limited by Art. 15 (4) of the GDPR, which states that "the right to obtain a copy shall not adversely affect the rights and freedoms of others". This means that the person responsible for the Processing Responsible persons must take into account the rights of third parties—such as their data protection rights, trade secrets, or intellectual property rights—when responding to a request for access to the data. In addition, it should be noted that the Right to information can only be exercised if a Processing on personal data (however, the term personal data is to be understood broadly). The Right to information therefore does not extend to the Processing of general information that is not intended as personal data or personal information. In a ruling dated December 20, 2017, the European Court of Justice ruled in a case involving the written answers of a candidate in a professional examination that the candidate’s answers and the examiners“ comments constitute “personal data” are to be considered personal data, but not the exam questions, “which, as such, do not constitute personal data of the candidates.“ Similarly, the ECJ held that a “legal analysis, […] although it personal data as such does not constitute personal data". This approach was also followed by the German Federal Court of Justice, which came to the conclusion that "data on commission payments to Third " not as personal data may be regarded as belonging to the policyholder and therefore do not fall under the Right to information fall.

Risks of not responding to an access request

Pursuant to Article 82 (1) GDPR can use the affected person can claim compensation if he or she has been injured as a result of a breach of the GDPR has suffered material or immaterial damage. In a decision dated March 5, 2020, the Düsseldorf Labour Court awarded a data subject compensation in the amount of EUR 5,000, as the copy of the personal data that the person responsible for the Processing Responsible persons to the person concerned was incomplete and was not provided in good time. The AG Düsseldorf argued that due to the months-long delay, the [affected person] "in the dark" about the Processing of her personal data and that she therefore suffered non-material damage.

However, not all German courts are of the opinion that a delayed response to a request for information gives the data subject the opportunity to claim damages. In its decision of July 1, 2021, the Regional Court of Bonn held that the mere fact that a data subject was not available for the Processing controller has not responded to the data subject in a timely manner does not per se mean that the data subject must be granted compensation. In order to trigger the application of Art. 82 (1) GDPR, the affected person can prove that he or she has been deprived of his or her rights as a result of the Processing controller has suffered (non-material) damage. It should be noted that the concept of "non-material damage" within the meaning of Art. 82 GDPR is currently the subject of intense debate and that the European Court of Justice has been asked by the Austrian Supreme Court to interpret this concept in accordance with Art. 82 of the General Data Protection Regulation.

Nevertheless, the Processing The controller may also be fined pursuant to Art. 83 (5) of the General Data Protection Regulation: if a person responsible for the Processing the rights of the data subject, e.g. the right to data portability. Right to information, it may be subject to a fine of up to 20,000,000 EUR or up to 4 % of its total worldwide annual revenue for the preceding fiscal year. In 2020, the French Regulatory Authority against one for the Processing Responsible persons Fine in the amount of EUR 2,250,000 for violating several data protection provisions, including Art. 15 of the General Data Protection Regulation.

Sources:

1. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 on the protection of natural persons with regard to the Processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
2. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data. Processing of personal data and the free movement of data.
3. CNIL (The French Regulatory Authority), GDPR: What’s the Assessment Six Months After It Took Effect?, November 23, 2018
4. Higher Administrative Court of Lüneburg, June 26, 2019, 11 LA 274/18, paras. 15–16.
5. ECJ, Peter Nowak v. Data Protection Commissioner, December 20, 2017, C-434/16, Rec. 57.
6. RecG. 63 of the GDPR.
7. Cologne Regional Court, 26th Civil Division, Judgment of June 19, 2019, 26 S 13/18.
8. Cologne Regional Court, 26th Civil Division, Judgment of June 19, 2019, 26 S 13/18, para. 39.
9. Cologne Regional Court, 26th Civil Division, Judgment of June 19, 2019, 26 S 13/18, para. 39
10. Cologne Regional Court, 26th Civil Chamber, Judgment of June 19, 2019, 26 S 13/18, Consideration 42.
11. Federal Court of Justice, judgment of June 15, 2021, VI ZR 576/19.
12. Federal Court of Justice, judgment of June 15, 2021, VI ZR 576/19, Rec. 22.
13. ECJ, Peter Nowak v. Data Protection Commissioner, December 20, 2017, C-434/16, Rec. 58.
14. ECJ YS v. Minister voor Immigratie, July 17, 2014, C-141/12, Rec.39.
15. Federal Court of Justice, judgment of June 15, 2021, VI ZR 576/19, Rec. 28.
16. Düsseldorf Labor Court, Judgment of March 3, 2021, 9 Ca 6557/18.
17. Düsseldorf Labor Court, Judgment of March 3, 2021, 9 Ca 6557/18, para. 111.
18. Regional Court of Bonn, judgment of July 1, 2021, 15 O 372/20, Rec. 33.
19. Supreme Court, decision of April 14, 2021, 6Ob120/21x.
20. CNIL, decision of November 18, 2020, no. SAN-2020-008.