The Higher Regional Court (OLG) Hamm had to decide whether and under what conditions a right of access under Art. 15 GDPR can constitute an abuse of rights.
When can access to information be requested under the GDPR?
The plaintiff was health insured through the defendant. The plaintiff's lawsuit challenged the defendant's premium increases. Furthermore, the plaintiff also requested access to information (Art. 15 GDPR) regarding the personal data processed about him by the defendant. According to this, anyone can request information about their processed personal data. This includes information about personal data and details such as processing purposes, the categories of personal data being processed, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, etc.
When can a request for access be refused?
In the case of manifestly unfounded or excessive requests from a data subject, the controller may, in accordance with Section 12 (5) GDPR, charge a reasonable fee for providing the information or refuse to provide it.
When does a right of access constitute an abuse of rights?
Whether a right of access constitutes an abuse of rights must be assessed separately in each individual case.
When assessing this, the protective purpose of the right of access under the GDPR must also be considered. One of the aims of the GDPR is to provide data subjects with an easily accessible right of access. However, the data subject must also have a genuine interest in receiving the information. They must not submit the request for access based on ulterior motives. If a data subject asserts a right of access under Section 15 GDPR that does not relate to verifying the data protection lawfulness of data collection, then the right of access is no longer covered by the protective purpose of the GDPR and is therefore an abuse of rights.
What does this mean for your right of access?
If you are considering requesting information from a company about the personal data collected about you, the sole objective of such a request should be to ascertain the lawfulness of the data processing. To ensure that your right of access is successful and not deemed an abuse of rights, you should assert your request for access through legal representation by our firm. We would be pleased to assist you.
Source: Higher Regional Court Hamm, Decision of 15.11.2021, Ref. No. 20 U 269/21 (legally binding)
GoldbergUllrich Attorneys-at-Law 2022
Attorney Christopher Pillat, LL.M.
