Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

North Rhine-Westphalia: District Court of Cologne clarifies that right of access and right to obtain copy of personal data constitute separate rights under GDPR

The District Court of Cologne issued, on 16 February 2022, its judgment in Case No. 28 O 303/20, in which it ordered S Köln L GmbH und Co. KG to provide the plaintiff with a copy, in a common electronic format, of their personal data, for violations of Articles 12(3), 15(1), and 15(3) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint lodged by an individual.

Background to the judgment

In particular, the District Court reported that the plaintiff had a contractual relationship with S Köln L for the rental of a virtual office. In addition, the District Court noted that, following the relocation of the plaintiff's virtual office to another centre owned by S Köln L and issues with the fee payments, the plaintiff had asked S Köln L to obtain access to their personal data. Subsequently, the District Court outlined while that S Köln L had provided the plaintiff with information on their personal data as per Article 15(1) of the GDPR, although belatedly, it had not provided the plaintiff with a copy of the personal data as per Article 15(3) of the GDPR. Further to this, the District Court stated that the plaintiff had requested the District Court to order S Köln L to provide the plaintiff with a copy of their personal data.

Findings of the District Court

Further to the above, the District Court clarified that Article 15(3) of the GDPR grants data subjects an independent right to obtain a copy of their personal data and that this right supplements the right of access pursuant to Article 15(1) of the GDPR and is not identical to it. In addition, the District Court specified that the spirit and purpose of Article 15(3) of the GDPR speaks in favour of an independent claim for the release of a copy of the raw version of the processed personal data, since this is the only way for the data subject to assess the scope and content of the data held by the controller.

On this basis, the District Court considered that the plaintiff's initial request encompassed both a request to access information on their personal data held by S Köln L as well as a request to obtain a copy of the same. However, the District Court determiend that, upon receiving such request, the defendant had only provided the plaintiff with information in accordance with Article 15(1) of the GDPR, but not with a copy of the data in the raw version, in line with the meaning of Article 15(3) of the GDPR.

Thus, the District Court found that S Köln L was in violation of the GDPR, as the same had not provided the plaintiff with information pursuant to Article 15(1) of the GDPR within the one-month period pursuant to Article 12(3) of the GDPR, and, in addition, had not provided the plaintiff with a copy of their personal data, in accordance with Article 15(3) of the GDPR.

Outcomes

In conclusion, the District Court ordered S Köln L to provide the plaintiff with a copy of their personal data, to be made available in a common electronic format, since the plaintiff had submitted the initial request in such a manner. Lastly, the District Court highlighted that the appeal against the judgment may be lodged before the Cologne Higher Regional Court within one month.

You can read the judgment, only available in German, here.

Feedback