GDPR right to information also applies in case of "disproportionate effort"

In a ruling, the Federal Fiscal Court (BFH) has clarified the scope of the right to information enshrined in the General Data Protection Regulation (GDPR). According to the ruling, the responsible body cannot reject a request for information under Article 15 GDPR with the argument that collecting the requested information would require "disproportionate effort". A request for information is also not considered excessive if the data subject does not limit their request either in terms of content or time.

According to the recently published decision from January 14 (case reference: IX R 25/22), a right to information is only fulfilled if the information constitutes the disclosure of the requested personal data "to the full extent owed" according to the declared intention of the responsible body. Previously, the European Court of Justice (ECJ) also defined the right to information for those affected by scoring 2023 quite broadly. The corresponding right is considered an important basis for safeguarding the privacy of citizens in the EU.

The specific case before the Federal Fiscal Court concerned a board member of a public limited company and participant in a so-called dormant company associated with it, who demanded that a tax authority "provide copies of all stored information" of the main company with reference to the GDPR. The tax authority then sent him various overviews such as basic and assessment data in May 2020. The applicant then complained that the tax office had not provided all of the documents required to be submitted in accordance with Article 15 GDPR that were available there. The authority assured its willingness to inspect the files, but refused to send all relevant files.

Claim for damages too late

The entrepreneur took legal action against this attitude before the tax court. He also requested information on whether the tax office had used procedures for automated decision-making, including profiling. In such cases, he also requested meaningful information about the logic involved and the scope and intended effects of such processing for the data subject. He was also interested in the existence of rights of appeal, rectification or erasure and the storage period of his data. He also requested a copy of the personal information processed about him by the authority.

The person concerned was initially unsuccessful at the competent tax courts, so he lodged an appeal with the BFH. He complained of a material breach of the GDPR and procedural errors. The listing of internal administrative processes, the content of which was not clear, did not constitute a sufficient provision of information. He also claimed damages in the amount of 450 euros for the costs incurred in connection with the inspection of the files. The BFH has now overturned the ruling of the Thuringian tax court from February 2022 and referred the case back to the court for a new hearing and decision. It also transferred the costs of the proceedings to the court. However, the plaintiff was not awarded damages, as he had inadmissibly only applied for these in the appeal proceedings.

(nen)