The Berlin Administrative Court (VG Berlin) has ruled that Judgment of October 12, 2023 (1 K 562/21) the refusal to provide information in accordance with Art. 15 GDPR. A passenger of the Berlin S‑Bahn had, in accordance with Art. 15 GDPR Information about video recordings from him. The S‑Bahn had refused to provide the information because, among other things, the persons recorded were not identified and it was not possible to identify the passenger with the description he had provided.
The Pankow Local Court as the lower court had refused to provide the information or denied a violation of the right to information and rejected a corresponding claim for damages:
Art. 12 et seq. GDPR does not Exception due to unreasonableness but the legal concept of Section 275 (2) BGB applies in general. (“The debtor may refuse performance if this requires an effort that is grossly disproportionate to the creditor’s interest in performance, taking into account the content of the obligation and the requirements of good faith. […]”), and it is also contained in recital 62 (“However, the obligation to provide information does not apply if […] informing the data subject proves impossible or involves a disproportionate effort […]”).
Also from the Principle of good faith – which is generally applicable on the basis of the Charter and Art. 5 para. 1 GDPR – a right of refusal arises if a service is grossly disproportionate to the creditor’s interest. In the present case, the fact that the passenger had not stated the purpose of the request for information played a role; this argued for a Little interest in information.
The VG Berlin also doubts that the recordings were made at all. personal data but left the question open. In principle, they do appear to be personal:
It is true that the recordings of persons by video surveillance cameras are likely to constitute personal data within the meaning of Art. 4 No. 1 GDPR, at least from an abstract point of view. This is supported by the fact that the data is recorded and stored precisely in order to be able to identify persons if necessary. The legislator also assumes in Section 20 (1) BlnDSG that personal data is collected and processed in the context of video surveillance of publicly accessible areas.
However, such an approach is probably too abstract:
However, the fact that, according to the legal definition in Art. 4 No. 1 GDPR, “a person” who “can be identified” is considered identifiable speaks against a purely abstract approach. The classification of data as personal is therefore also requires a concrete-subjective moment, i.e. whether the person to whom the data relates can actually be identified by the controller, taking into account all means that the controller can reasonably be expected to use for this purpose. If it is not possible for the controller to identify the data, the data should not be personal data, but should be anonymous (for the controller), even if a third party, whose access to the data is unlikely, would be able to identify the data […]. Based on this, there is again some evidence that the recording of the persons captured in the context of video surveillance in the suburban trains do not constitute personal data for the plaintiffbecause it should not be possible to identify the persons with the means available to it from a realistic point of view.
In the PinG 1/2024 Müller-Peltzer, Selz and Surjadi criticize this application of the prohibition of abuse of rights. According to them, the refusal should rather have been justified by the fact that the video recordings must be deleted after 48 hours under the applicable law. The longer storage – demanded by the plaintiff – for the purpose of obtaining information would have impaired the rights of the other passengers, which is contrary to Art. 15 para. 4 GDPR.