Unfounded, time-barred or excessive requests for information.
In its judgment of 15.12.2022 – 8 U 165/22, the OLG Celle dealt, among other things, with the question of the extent to which a request for information under data protection law can be rejected pursuant to Article 15 of the GDPR due to unfoundedness, statute of limitations or excess. The court held that the right of access serves the purpose of ensuring that the data subject is aware of the processing of his or her personal data in order to be able to verify its lawfulness. First-time requests for information cannot generally be refused as manifestly unfounded or excessive requests within the meaning of Article 12(5), second sentence, of the GDPR, as these are not requests that are frequently repeated. The motivation of the data subject is irrelevant because the regulation does not make the right to information dependent on a specific objective of the claimant and a request for information does not have to be substantiated. A right to information also exists if the data subject already has the requested information. A right of access has no time limit and can also extend to information collected and/or stored in periods prior to the entry into force of the GDPR on 18 May 2018.
The plaintiff filed a complaint against premium adjustments of a private health insurance contract by the insurer and demanded information about all factors triggering the premium adjustments as well as the amount of the premium adjustments from the years 2012, 2013 concerning the insurance contract concluded between the parties. The defendant insurance company, on the other hand, took the view that Article 15 of the GDPR did not give rise to such a right to information, as the information only had to enable the data subject to check the lawfulness of the storage of data relating to him. Moreover, the plaintiff was in possession of all the documents to which the right to information related. Moreover, any claims up to and including 2017 were time-barred.
The court ordered the insurance company to provide the plaintiff with information about all premium adjustments and the related information. According to the court, the plaintiff has a right to information under Article 15 of the GDPR. The right to information serves the purpose of ensuring that the data subject is aware of the processing of personal data in order to be able to check its lawfulness. “Letters from the insurer to the policyholder are, in principle, to be regarded as personal data in accordance with Article 4(1) of the GDPR in their entirety.” (para. 119) Thus, the criteria for a claim for information regarding the supplements to the insurance policy sent by the defendant to the plaintiff on the occasion of the premium adjustments are given.
According to the court, the request for information was also not a manifestly unfounded or excessive request within the meaning of Article 12(5), second sentence, of the GDPR. According to the regulation, these are excessive requests that are frequently repeated. In the present case, however, this was not the case because the plaintiff had requested a copy of the relevant documents for the first time. “The motivation of the plaintiff is also irrelevant because the Regulation does not make the right to information dependent on a specific objective of the claimant and accordingly the request for information does not have to be substantiated.” (para. 121)
The court also held that a right to information under 15 GDPR also exists if the data subject already possesses the requested information (see BGH, judgment of 15 June 2021 – VI ZR 576/19; VG Schwerin, judgment of 29 April 2021 – 1 A 1343/19 SN). Thus, it is irrelevant whether the plaintiff is already in possession of the information originally provided to him.
In addition, the right to information is not precluded by the fact that it concerns information from the period before the GDPR came into force on 18 May 2018. The GDPR does not contain any explicit time limit for the right of access, “which speaks in favour of an unrestricted right of access also with regard to such information that was collected and/or stored before 25 May 2018”. (para. 123) The protection of personal data is a consequence of fundamental rights, which would be rendered meaningless if the right to information were to extend only to information from the period after the entry into force of the GDPR.
It is not necessary to decide whether a limitation of the claim for information based on a secondary contract is possible at all. “For even if the claim for information, like the claim for information based on § 242 BGB, were to become time-barred independently and autonomously according to the general time limit of § 195 BGB, it could not, however, in any case become time-barred before the main claim which it serves.” (para.124)