On February 6, 2020, the Heidelberg Regional Court issued a ruling on the right to information under the GDPR (Case No. 4 O 6/19). The plaintiff, a former board member of the defendant responsible party, had requested not only his personnel file, but also email correspondence with approximately 10,000 emails that had already been archived. The responsible party defended itself against the latter, arguing that the costs for restoring them would be around EUR 4,000 and for reviewing and redacting the e‑mails around EUR 120,000.
The district court essentially upheld the responsible party. The court’s considerations are ultimately based on the general principle that the GDPR does not require anything impossible. In this respect, the ruling has significance beyond the specific constellation assessed.
The court first assumes that the effort is disproportionate in relation to the lack of or low interest in information be:
In any case, the court is convinced that the requested information would involve a disproportionate effort for the defendant. It is comprehensible and plausible for the court that in order to obtain the data, it would first have to be restored to the old servers of the AG. In this respect, the court has no doubt that costs of up to €4,000 would be incurred.
Furthermore, the court assumes that the data category e‑mails is in any case several thousand e‑mail is likely to include. […] The The fundamental need to view and redact these e‑mails in order to protect the legitimate interests of third parties is undisputed between the parties. and is also recognized in case law […]. Even if the court assumes a significantly lower number of e‑mails In combination with an average value of processed e‑mails per day, the preparation of the data would keep a person busy for weeks. This in relation to the – in the opinion of the court if at all to be classified as minor – interest of the plaintiff in information The court considers this to be a disproportionate effort. In the present case, the e‑mails in question are already nine to ten years old. In addition, the plaintiff has not worked for the AG for nine years. This does not even exist in the previous form. more. It is quite significant for the court that the plaintiff did not assert his claim for information until Years after the termination of the activity for the AG in civil proceedings before the Heidelberg Regional Court […]. […]
However, it is not entirely clear what the court is relying on here. The GDPR does not provide for an exception to the right to information on the grounds of disproportionate effort, but only for “manifestly unfounded” or “excessive requests” (Art. 12(5) GDPR). The court instead referred to the old version of the German Federal Data Protection Act, BDSG, and to a literature passage according to which the GDPR cannot require anything impossible:
[…] For the court it is quite comprehensible that in the present case no storage media are any longer in the possession of the AG; but rather these were comprehensively handed over to the Q. A possible right of access of the defendant to the former servers of the AG does not necessarily change this. Data in backups may not be immediately accessible to the person responsible.. In accordance with Section 34 (7) in conjunction with Section 33 (2) sentence 1 no. 2 of the old version of the BDSG, information could not be provided if the data was used exclusively for data backup and notification would have required disproportionate effort. However, the omission of this special standard does not mean that all backups are now subject to the obligation to provide information. Rather, it also depends here on the specific effort on the part of the responsible party. (cf. Gala DS-GVO/Franck, 2nd ed. 2018, DS-GVO Art. 15 marginal no. 42), see below.
The court refers to Gola, who says the following in this regard:
Since good faith hovers over the entire processing operation pursuant to Article 8 (2) sentence 1 CFR and Article 5 (1) lit. a, no disproportionate effort is required of the controller per se. Admittedly, very strict standards must be applied with regard to the disproportionality of transparency rights.