The ruling of the Federal Fiscal Court (BFH) from January 14, 2025 (case no. IX R 25/22) deals with an important case on the interpretation of Art. 15 GDPR. It concerns the question of whether the controller can refuse to provide information on the grounds of "disproportionate effort".
Tax office: Disproportionate effort not reasonable
The plaintiff is a board member of a stock corporation (Z-AG) and was also involved in a related atypical dormant company (Z-atypisch still). In his function as a board member and due to his financial participation, he considered himself to be affected by the data processing of the tax office. The plaintiff therefore requested comprehensive information from the tax office about all personal data concerning him in accordance with Art. 15 GDPR.
The tax office initially sent some overviews with basic data, notification data and eData. However, in the plaintiff's opinion, this transmission was incomplete. The attorney of record appointed by him objected to the fact that not all documents available at the tax office and required to be submitted in accordance with Art. 15 GDPR had been provided. This prompted the FA to interpret the request as a request for full access to the files, which was granted to the plaintiff. However, the plaintiff later clarified that his request explicitly referred to the provision of personal data in accordance with Art. 15 GDPR.
Despite repeated requests, the tax office maintained its stance that it was unreasonable to expect the personal data to be sent in full due to the disproportionate effort involved. As part of the proceedings, the plaintiff also demanded compensation in the amount of EUR 450 for costs incurred in connection with the inspection of the files.
Disproportionate effort: this is how the Federal Fiscal Court ruled
The Federal Fiscal Court ruled in favor of the plaintiff and stated that:
- The controller may not refuse the right to information under Art. 15 GDPR with the argument that providing the information would cause a disproportionate effort.
- A request for information is not to be considered excessive solely because it does not contain a factual or time limit.
- The plaintiff is also entitled to a copy of the processed personal data in accordance with Art. 15 para. 3 GDPR.
Reading tip: ECJ strengthens transparency - credit agencies must disclose decision-making processes
Provision of information not dependent on proportionality test
In its reasoning, the court pointed out that the GDPR does not contain any provision that allows a controller to reject a right to information on the grounds that it would require a disproportionate effort. While Art. 14 para. 5 lit. b GDPR expressly provides for the possibility that an obligation to provide information may be waived under certain conditions due to disproportionate effort, such a restriction is completely absent in connection with the right of access under Art. 15 GDPR.
According to the court, there is therefore no general principle according to which the provision of information under Art. 15 GDPR can be made dependent on a proportionality test. The BFH emphasized that the right to information is a central right of the data subject to ensure transparency and control over their own personal data. This right cannot be restricted by organizational or logistical challenges faced by the data controller.
The court also referred to the special significance of the provision of copies in accordance with Art. 15 para. 3 GDPR. It clarified that the possibility to inspect files is not the same as fulfilling the right to copies. While access to the file only provides a temporary insight into the information, the provision of a copy enables the data subject to have permanent access to their personal data. The copy must contain all relevant personal data and must not be incomplete or selective.
Furthermore, the court emphasized that a request for information is not to be classified as excessive simply because the applicant has not formulated any factual or temporal restrictions in their request. Art. 15 GDPR grants a comprehensive right of access that extends to all personal data processed by the controller. This is the only way for the data subject to obtain information about the processing of their data and to verify its lawfulness.
The court concluded by clarifying that the responsible party has a special duty to provide reasons in the event of an allegedly excessive request and that the rejection of such a request can only be justified under strict conditions.
Practical relevance and significance
The ruling significantly strengthens the rights of data subjects under the GDPR. In future, data controllers will no longer be able to use the "disproportionate effort" argument to refuse to provide comprehensive information.
This means that companies and authorities have an increased duty of care when dealing with requests under Art. 15 GDPR. Responsible bodies should implement suitable measures for the efficient fulfillment of such requests at an early stage, especially in complex data pools.
The ruling also underlines the importance of clearly distinguishing between full information and the mere possibility of accessing files. Data protection officers and compliance officers should take this differentiation into account in practice in order to act in a legally compliant manner.
Source: Federal Fiscal Court, judgment of 14.01.2025, Ref. IX R 25/22
Do you still have questions about dealing with requests for information? Our experts will support you with individual solutions. Get in touch with us:
☎️ +49 (228) 926165-100
📧 info@2b-advice.com
English 
German 
Italian 
French