Continue reading on DataGuidance with:
Free Member
Limited ArticlesCreate an account to continue accessing select articles, resources, and guidance notes.
Already have an account? Log in
Berlin: Federal Administrative Court rules access to 5,000 pages of data not disproportionate effort under GDPR
On February 6, 2024, the Berlin Administrative Court (the Court) issued its decision, in case number ECLI:DE:VGBE:2024:0206.1K187.21.00, in which the Court held, among other things, that controllers can use the exception of disproportionate effort for not complying with a data subject access request under Article 15(1) of the General Data Protection Regulation (GDPR) only in limited exceptional cases.
Background to the decision
In particular, the Court stated that the plaintiff had requested information from the defendant about their personal data and complained that the defendant provided incomplete information. The Court added that according to the defendant, the plaintiff's request would involve disproportionate effort since the defendant would be required to look at documents from over 100 proceedings conducted by the plaintiff over the last 20 years, which would be over 5,000 pages of files.
Findings of the Court
The Court held that the defendant could not successfully counter the plaintiff's claim under Article 15(1) of the GDPR with the objection of disproportionality or abuse of law. The Court also noted that it does not ignore the fact that the provision of copies of all documents contained in the defendant's administrative processes in which the plaintiff's personal data is processed is a significant step. However, owing to the importance of the right to information under Article 15(1) of the GDPR, the controller can use the exception of disproportionate effort in very limited exceptional cases. For example, a gross disproportion is required between the efforts required to fulfill the right to information and the interest in information of the person concerned. The Court held that this requirement was not met in the present case.
Outcomes
In light of the above, the Court held the above and determined that the defendant would be obliged to provide the plaintiff with their personal data and ordered costs of the proceedings payable two-thirds by the defendant and the remaining by the plaintiff.
You can read the decision, only available in German, here.