The Higher Regional Court of Hamm (OLG Hamm) had to decide whether and under which conditions a claim for information under Article 15 of the GDPR can be abusive.
When can information be requested under the GDPR?
The plaintiff had health insurance through the defendant. The plaintiff filed a complaint against the defendant's premium increases. Furthermore, the plaintiff also demanded information (Article 15 of the GDPR) about the personal data processed about him by the defendant. According to this, anyone can request information about the personal data processed about him. This includes information on personal data and information such as the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the planned duration for which the personal data will be stored, etc. The plaintiff is also entitled to request information on the personal data processed by the defendant.
When can a request for information be refused?
In the case of manifestly unfounded or excessive requests by a data subject, the controller may, pursuant to Section 12(5) of the GDPR, charge a reasonable fee for the information or refuse to provide it.
When is a claim for information abusive of the law?
When a claim for information is abusive is to be assessed separately in each individual case.
The protective purpose of the right to information in the GDPR must also be taken into account in the assessment. The purpose of the GDPR is, among other things, to provide data subjects with a right to information without any problems. However, the data subject must also have a first interest in the provision of information. He or she may not make the request for information on the basis of downstream interests. If the data subject asserts a right to information pursuant to Section 15 of the GDPR that does not relate to examining the permissibility of the data collection under data protection law, the right to information is no longer covered by the protective purpose of the GDPR and is therefore abusive.
What does this mean for your right to information?
If you are thinking of requesting information from a company about the personal data collected from you, the aim of the request for information should only be the lawfulness of the data processing. In order to ensure that your request for information is successful and is not considered to be an abuse of rights, you should assert your request for information through us as a lawyer. We will be happy to act on your behalf.
Source: OLG Hamm, decision dated 15.11.2021, ref. no. 20 U 269/21 (legally binding)
GoldbergUllrich Lawyers 2022
Attorney at Law Christopher Pillat, LL.M.
