The ruling of the Federal Fiscal Court (BFH) from January 14, 2025 (case no. IX R 25/22) deals with an important case on the interpretation of Art. 15 GDPR. The question is whether the Responsible persons can refuse to provide information with the argument "disproportionate effort".
Tax office: Disproportionate effort not reasonable
The plaintiff is a board member of a stock corporation (Z-AG) and was also involved in a related atypical dormant company (Z-atypisch still). In his function as a board member and due to his financial participation, he considered himself to be affected by the data processing of the tax office. The plaintiff therefore demanded comprehensive information from the tax office about all data concerning him. personal data pursuant to Art. 15 GDPR.
The tax office initially sent several overviews with basic data, notification data and eData. These Transmission was, however, incomplete in the opinion of the plaintiff. The legal representative appointed by him objected to the fact that not all of the information available to the tax authorities and required under Art. 15 GDPR documents to be submitted had been provided. This prompted the FA to interpret the request as a request for full access to the files, which was granted to the plaintiff. However, the plaintiff subsequently clarified that his request explicitly referred to the provision of personal data in accordance with Art. 15 GDPR referred to.
Despite repeated requests, the tax office maintained its stance that it was unreasonable to expect the personal data to be sent in full due to the disproportionate effort involved. As part of the proceedings, the plaintiff also demanded compensation in the amount of EUR 450 for costs incurred in connection with the inspection of the files.
Disproportionate effort: this is how the Federal Fiscal Court ruled
The Federal Fiscal Court ruled in favor of the plaintiff and stated that:
- The Responsible persons the right to information pursuant to Art. 15 GDPR may not refuse to provide the information on the grounds that it would involve a disproportionate effort.
- A request for information is not to be considered excessive solely because it does not contain a factual or time limit.
- The plaintiff is also entitled to a copy of the processed personal data pursuant to Art. 15 (3) GDPR. GDPR has.
Reading tip: ECJ strengthens Transparency - Credit agencies must disclose decision-making processes
Provision of information not dependent on proportionality test
In its reasoning, the court pointed out that the GDPR does not contain a provision that allows a controller to refuse a request for information on the grounds that it would require a disproportionate effort. While Art. 14 para. 5 lit. b GDPR expressly provides for the possibility that an information obligation may be waived under certain conditions due to a disproportionate effort, there is no such restriction in connection with the Right to information according to Art. 15 GDPR complete.
In the opinion of the court, there is therefore no general principle according to which the provision of information pursuant to Art. 15 GDPR can be made dependent on a proportionality test. The BFH emphasized that the right to information is a central right of the data subject in order to Transparency and control over their own personal data. This right cannot be restricted by organizational or logistical challenges faced by the controller.
The court also referred to the special significance of the provision of copies pursuant to Art. 15 para. 3 GDPR. In doing so, it clarified that the possibility to inspect files is not to be equated with the fulfillment of the right to copies. While access to the file only provides a temporary insight into the information, the provision of copies enables the data subject to have permanent access to their personal data. The copy must contain all relevant personal data and must not be incomplete or selective.
Furthermore, the court emphasized that a request for information is not to be classified as excessive simply because the applicant has not formulated any factual or temporal restrictions in his request. Art. 15 GDPR provides a comprehensive Right to informationwhich extends to all personal data that the data controller Responsible persons processed. Only in this way can the affected Person via the Processing of their data and to check the lawfulness of this data.
In conclusion, the court clarified that the Responsible persons in the event of an allegedly excessive request, the court has a special duty to state reasons and the rejection of such a request can only be justified under strict conditions.
Practical relevance and significance
The ruling strengthens the rights of affected persons under the GDPR considerable. Responsible persons In future, authorities will no longer be able to use the "disproportionate effort" argument to refuse to provide comprehensive information.
This means that companies and authorities have an increased duty of care when dealing with requests under Art. 15 GDPR. Especially in complex databases responsible implement suitable measures for the efficient fulfillment of such requests at an early stage.
The ruling also underlines the importance of clearly distinguishing between full information and the mere possibility of accessing files. Data protection officers and compliance officers should take this differentiation into account in practice in order to act in a legally compliant manner.
Source: Federal Fiscal Court, judgment of 14.01.2025, Ref. IX R 25/22
Do you still have questions about dealing with requests for information? Our experts will support you with individual solutions. Get in touch with us:
☎️ +49 (228) 926165-100
📧info@2b-advice.com
German 
English 
Italian 
French