Federal Court of Justice: no general right under Article 15(3) GDPR to the disclosure of complete documents

In its ruling of March 5, 2024, the Federal Court of Justice clarified that the right to "copies" within the meaning of Art. 15 para. 3 GDPR does not refer to the complete documents relating to the data subject. The claim only relates to the personal data itself, not to the documents in which it is contained. The data subject may request complete copies of such - still existing - documents that they themselves have created and sent to the party obliged to provide information, such as their own emails or letters. However, there is generally no entitlement to the complete handover of, for example, file notes, telephone notes or consultation minutes.

The judgment of the Federal Court of Justice (case no. VI ZR 330/21) was issued in the context of an action brought by an investor who, on the basis of Art. 15 para. 3 sentence 1 GDPR, had demanded that the intermediary of a capital investment provide her with copies of all documents relating to her from the long-standing business relationship. The purpose of the claim was indisputably to give the plaintiff access to possible evidence for the parallel damages proceedings it was conducting. While the claim for damages was unsuccessful in all instances, the request for information was largely successful in the first two instances.

The BGH initially suspended the proceedings by order of 21.02.2023 in order to await the rulings of the European Court of Justice (ECJ) in cases C-487/21 and C-307/22, which are also relevant to the present decision. In its judgment of 4 May 2023, the ECJ ruled in case C-487/21 that the term "copy" refers to the data itself, not generally to copies of all documents relating to the data subject. However, the right to receive a copy of personal data pursuant to Art. 15 para. 3 sentence 1 GDPR means that the data subject must receive a faithful and intelligible reproduction of all such data if the provision of a copy is essential to enable the data subject to exercise his or her rights under the GDPR. However, the rights and freedoms of others, such as trade secrets or intellectual property rights, must be taken into account. The term "information" in Art. 15 para. 3 sentence 3 GDPR only refers to the data of the data subject. In a further ruling dated 26.10.2023, the ECJ clarified the interpretation for medical treatment records.

In the current ruling, the VI Civil Senate of the BGH states that the plaintiff has no right to information with regard to all of the investment broker's documents concerning her from the contractual relationship. The term "data" is to be understood broadly and is not limited to sensitive or private information. However, the right to receive a copy relates only to the personal data itself and does not mean the provision of complete copies of all documents relating to the data subject. Therefore, letters and emails sent by the data subject themselves must be provided in full as copies, as the personal information already consists of the fact that the person has made a corresponding statement. By contrast, data from other documents, such as letters from the party obliged to provide information to the data subject, would only have to be transmitted to the extent that they contain data of the data subject in accordance with the aforementioned standards. It is conceivable that the contextualization of the data could include the disclosure of further parts of documents if this is necessary to make the personal data comprehensible. However, this would have to be demonstrated by the plaintiff if he/she requested the disclosure of copies of all documents.

However, the BGH rejects a restriction of the right to information to documents from the period of application of the GDPR. Therefore, in the case of long-standing business relationships, all personal data that still exists must be handed over. Furthermore, the fact that a document is already known to the data subject does not exclude the right to information under data protection law.

In procedural terms, the BGH clarified that the disclosure of extracts of the existing documents is not a "minus" to the requested disclosure of the complete documents (each in copy). Due to the form in which the application was submitted, the plaintiff was therefore completely unsuccessful in the proceedings in question with regard to documents that it had not written itself; a conviction only for the disclosure of the personal data contained therein was out of the question.

Finally, the Federal Court of Justice did not make the success of the right to information dependent on it being used for purposes that the GDPR mentions or approves. The restriction of the claim to the personal data itself at least partially prevents the right to information under data protection law from being misused for the court-ordered production of evidence (so-called "pre-trial discovery").

Back