- The Regional Court of Cologne affirms a broad right to information in accordance with Art. 15 GDPR in relation to stored personal data, but not any internal information.
- No general right to copies of files: Only personal data is to be copied, not expert opinions, legal assessments or internal notes.
- Data of already known contents (e.g. e‑mails already received) are not necessarily subject to a copy claim; provision can be made in extractable form.
The Cologne Regional Court has ruled in a Partial judgment of 18.03.2019 (26 O 25/18) decided on the scope of the right to copy as part of the right of access under Art. 15 GDPR – a topic that is currently the subject of intense debate, because requests for information have a very broad scope of application according to the wording and, particularly in the employment relationship, may also include e‑mail correspondence, but also data such as password changes or on/off badge data. Further information on this can be found in articles by Tim Wybitul and Carlo Piltz.
Against this background, the partial judgment of the Cologne Regional Court is to be welcomed.
- Although it first states that the Comprehensive right to information is:
“related to the personal data stored or processed. This includes data such as name or date of birth as well as any characteristics that may allow the identification of a person, e.g. health data, account number, etc. According to these principles and based on the recitals, medical records, expert opinions or other similar communications from other sources also constitute ‘personal data’.”
- However, there is still no right to file copies:
“In the Board’s view, however, the right to information relates to. not to all internal processes of the defendant, such as endorsements, or to the fact that the person concerned all correspondence exchanged, which is already known to the person concerned, can be printed out and sent again […]. Legal assessments or analyses in this respect also do not constitute personal data in this sense. The claim under Article 15 GDPR is not intended to simplify the data subject’s accounting, but to ensure that the data subject can assess the scope and content of the stored personal data. Consequently, Article 15 (3) of the GDPR stipulates that the data subject must a copy (only) of the personal datawhich are the subject of the processing. In the present case, the defendant has provided various information […] and stated that further personal data about the plaintiff were not stored or processed. Substantiated submissions by the plaintiff as to what additional information could have been processed by the defendant have not been made.”
This clearly shows that the Cologne Regional Court assumes a broad scope with regard to the scope of the right to information; that the subject of the information and copy are not expert opinions and other documents, but only the personal data contained therein, if any.. The right to information therefore does not require the documents in question to be submitted. The data can also be provided extracted, e.g. as an Excel document.
This also corresponds to the position of the Bavarian supervisory authority, of the BayLDA. At Activity Report 17/18 holds it:
The right to information under data protection law pursuant to Article 15 of the GDPR relates, according to the wording of paragraph 1, to the provision of information about the personal data processed by the controller. However, this does not regularly mean the handover of all documents, e‑mails, etc., which contain, for example, the name of the data subject and any other information about that person. According to Article 15 (3) of the GDPR, only a “copy of the personal data which are the subject of the processing” must be made available. However, there is no mention here of copies of the files concerned, of other documents, etc.
Furthermore, it becomes clear that the Regional Court of Cologne does not see any right to information and thus also no right to a copy with regard to data which the data subject – e.g. as the subject of e‑mails – has been provided with. already known are.