BGH – VI ZR 330/21

27 January 2026

Avalang: Turned Articles into links.

{{COURTdecisionBOX

|Case_Number_Name=VI ZR 330/21
|ECLI=

|Date_Decided=05.03.2024
|Date_Published=05.03.2024
|Year=2024

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Initial_Contributor=avalang
|
}}

A court held that a request for access under [[Article 15 GDPR|Article 15(3) GDPR]] is entitled only to copies of personal data, not full document copies where personal data is mixed with other content.

== English Summary ==

=== Facts ===
The data subject was an employee of the controller, a financial advisory firm. On 11 April 2019, the data subject requested copies of all personal data the controller held about them under [[Article 15 GDPR#(3) Right to receive a copy of the personal data|Article 15(3) GDPR]], covering the years from 1 January 1997 to 31 March 2018.

The controller provided a standard disclosure of stored information but did not supply actual copies of documents.

The data subject then sued for damages and specifically sought court orders requiring the controller to hand over copies of all personal data, including telephone notes, file memos, minutes of conversations, emails, letters, and subscription documents related to investments.

The case progressed through the regional court and higher regional court, which differed on the scope of what must be provided.

Both controller and data subject appealed previous decisions.

=== Holding ===
First, the court clarified that the right under [[Article 15 GDPR#3|Article 15(3) GDPR]] to receive a “copy” of personal data does not automatically extend to entire documents simply because they contain personal data. It held that documents the data subject themself authored (such as emails and letters to the controller) are in their entirety personal data and must be supplied as copies because the personal data is inherent in the document. Documents or parts of documents created by the controller (such as telephone notes, file memos, minutes, letters from the controller, or investment subscription forms) are not wholly personal data of the data subject as they may contain mixed information.

Second, it clarified that the controller must provide only those portions that constitute the data subject’s personal data and need not turn over entire documents if parts are unrelated to the personal data.

Finally, the court therefore limited the data subject’s entitlement to copies of their own emails and letters held by the controller and dismissed requests for broader document disclosure.

== Comment ==
”Share your comments here!”

== Further Resources ==
”Share blogs or news articles here!”

== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.

<pre>
Principle

On the term “copy of personal data” in Article 15(3) GDPR.

Judgment

Upon the appeals of the defendants, the judgment of the 3rd Civil Senate of the Higher Regional Court of Munich of October 4, 2021, is set aside insofar as the judgment of the Regional Court of Munich I of April 6, 2020, is amended insofar as it was rendered to the detriment of the defendants. The judgment of the Regional Court is hereby reformulated as follows:

The defendants are ordered to provide the plaintiff with copies of the emails and letters written by the plaintiff and held by the defendants from the period January 1, 1997, to March 31, 2018.

The remainder of the claim is dismissed.

The defendants’ further appeals are rejected.

The costs of the appeal proceedings are to be borne by the plaintiff to the extent of 80% and by the defendants to the extent of 20%.

By Law

Facts of the Case

Defendant 1 worked as a financial advisor for the plaintiff from 1997. She advised the plaintiff on investments and insurance. From 2015 onwards, she provided this advisory service under the name of Defendant 2. By letter dated April 11, 2019, the plaintiff requested the defendants to provide her with copies of all personal data of the plaintiff held by the defendants, pursuant to Article 15(3) of the GDPR. The defendants are in possession of, among other things, telephone notes, file memos, and similar records of correspondence with the plaintiff in connection with the defendants’ work. The defendants sent the plaintiff information about the data they held concerning the plaintiff, but did not provide copies of any documents. The plaintiff subsequently amended her claim for damages in the first instance, requesting that the defendants be ordered to hand over “copies of all personal data—in particular, telephone notes, file memos, minutes, emails, letters, and investment subscription documents—in their possession.”

The Regional Court granted the plaintiff’s request to the extent of this and dismissed the remainder of the claim. On appeal by the defendants, the Higher Regional Court reversed the Regional Court’s judgment and, in response to the plaintiff’s alternative claim raised in the appeal proceedings, ordered the defendants to provide the plaintiff with “copies of the plaintiff’s personal data processed by the defendants, specifically concerning the data categories of telephone notes, file memos, meeting minutes, emails, letters, and investment subscription documents for the period from January 1, 1997, to March 31, 2018.” The court dismissed the defendants’ further appeal and the plaintiff’s appeal. The defendants, with leave to appeal granted by the Higher Regional Court, are now challenging their conviction. The plaintiff seeks to have the appeal dismissed and, in the alternative, requested during the appeal hearing that the defendants be ordered to provide the plaintiff with copies of the personal data processed by the defendants, which are contained in the data categories of telephone notes, file memos, meeting minutes, emails, letters, and subscription documents for capital investments during the period from January 1, 1997, to March 31, 2018.

Reasons for the Decision

The Higher Regional Court, insofar as relevant to the appeal proceedings, essentially reasoned as follows in its decision, which is published, inter alia, in DB 2021, 2755:

There are no concerns regarding the specificity of the plaintiff’s alternative request made in the appeal proceedings. For a creditor asserting a claim under Article 15(3) GDPR, it is generally not apparent which documents are held by the party obligated to provide information. Therefore, specifying the documents to be surrendered is not possible. The request to surrender all documents is sufficiently specific to require the defendants to provide copies of all documents in their possession. The plaintiff’s primary claim, which formed the basis of the Regional Court’s judgment, does not indicate that only documents relating to the plaintiff are to be surrendered. Therefore, the defendants’ judgment had to be specified accordingly.

The Regional Court was correct in ordering the defendants to surrender copies of the personal data they hold pursuant to Article 15(3) GDPR. The information evident from the operative part of the first-instance decision constitutes personal data. This includes all information relating to an identified or identifiable natural person. With regard to the data held by the defendants, a connection to the plaintiff can be established from the subject line or the contact person in each instance. Letters and emails from the plaintiff to the defendants constitute personal data in their entirety. Telephone notes, file memos, and minutes, as internal records of the defendants containing information about the plaintiff, are also to be classified as personal data. The plaintiff is not asserting the right of access under Article 15(1) GDPR in this case. The defendants have already provided the corresponding information prior to the commencement of legal proceedings. The plaintiff has an independent right to be provided with copies pursuant to Article 15(3) GDPR. Paragraphs 1 and 3 of Article 15 GDPR are two distinct rights that, while concerning the same subject matter, differ in their legal consequences. Under Article 15(3) GDPR, the data subject has the right to be provided with the information in the form in which it is held by the data controller. The necessary protection of the debtor is ensured by the possibility of redaction pursuant to Article 15(4) GDPR.

II.

These considerations do not fully withstand review on appeal. The plaintiff is entitled to the right granted by the Court of Appeals to the provision of copies of documents only insofar as these are letters and emails written by the plaintiff that are in the defendant’s possession from the period in question (see points 1 and 2). The plaintiff’s alternative claim, raised for the first time during the appeal hearing, is inadmissible as an amendment to the claim at the appeal stage (see point 3).

1. Contrary to the appellant’s view, the judgment of the Court of Appeals is not to be set aside simply because the alternative claim underlying the operative part of the contested decision is not sufficiently specific (Section 253(2) No. 2, Section 313(1) No. 4 of the German Code of Civil Procedure).

a) In principle, a statement of claim is sufficiently specific within the meaning of Section 253 Paragraph 2 No. 2 of the German Code of Civil Procedure (ZPO) if it concretely identifies the claim being asserted. On the one hand, the description must be precise enough that the risk of the plaintiff losing the case is not shifted to the defendant through avoidable inaccuracies, and that enforcement of the judgment can be expected without further litigation in enforcement proceedings. On the other hand, not every possible uncertainty in enforcement proceedings renders the statement of claim insufficiently specific. The requirements for specifying the subject matter of the dispute in a statement of claim depend on the specific features of the applicable substantive law and the circumstances of the individual case. The requirements for the specificity of the claim must therefore be determined by weighing the defendant’s legitimate interest in being able to mount a comprehensive defense against the claim, as well as their interest in legal clarity and certainty regarding the effects of the decision, against the plaintiff’s equally legitimate interest in effective legal protection (see Federal Court of Justice, Judgment of December 21, 2023 – IX ZR 238/22, juris para. 16; Senate Judgment of March 9, 2021 – VI ZR 73/20, NJW 2021, 1756 para. 15; each with further references). The use of terms requiring interpretation is only permissible if, on the one hand, further specification is neither possible nor reasonable for the plaintiff, and on the other hand, the parties have no doubt about their content, so that the scope of the claim and the judgment is clear (Federal Court of Justice, Judgment of December 2, 2015 – IV ZR 28/15, NJW 2016, 708 para. 8 with further references).

b) According to these standards, the alternative claim underlying the judgment is sufficiently specific – contrary to the appellant’s view.

aa) To determine the relief sought, one must not only consider the claim itself, but also the statement of claim (Federal Court of Justice, Judgment of June 15, 2021 – VI ZR 576/19, NJW 2021, 2726 para. 32 with further references). The alternative claim made in the appeal, which is to be interpreted by the Federal Court of Justice itself as a procedural declaration (see Federal Court of Justice judgment of June 29, 2021 – VI ZR 52/18, NJW 2021, 3130 para. 16 with further references), is aimed at providing the plaintiff with copies of all telephone notes, file notes, meeting minutes, emails, letters, and subscription documents for investments as complete documents that are in the defendant’s possession from the period specified in the claim and that contain information about the plaintiff. Even according to the wording of the claim, the plaintiff is not merely requesting copies of the personal data contained in telephone notes, file notes, meeting minutes, emails, letters, and subscription documents for investments, but copies of these documents in their entirety. The respondent supports this understanding by stating that the defendants are generally obligated to provide a copy of the complete documents in which the plaintiff’s personal data is embedded. In the grounds for the contested decision (cf. regarding the relevance of the grounds for the decision to the interpretation of the operative part of the judgment, Federal Court of Justice, decision of January 17, 2017 – XI ZR 490/15, NJW-RR 2017, 763 para. 2 with further references), the Court of Appeal stated that the request to produce all documents was unobjectionable, as it was sufficiently specific to require the defendants to produce copies of all documents in their possession. The information evident from the operative part of the judgment constitutes personal data, and the plaintiff has a right to receive the information in the form in which it is held by the data controller.

bb) The plaintiff’s claim, as granted by the Court of Appeal, is sufficiently specific with this content. The plaintiff is unable to define the term “personal data” more precisely or to identify the documents held by the defendants that contain such information. The plaintiff’s claim specifically seeks to ascertain which documents held by the defendants contain which information about her. The documents covered by the claim are sufficiently identifiable in this respect; this is sufficient for the claim to be specific, at least in this case (cf. regarding other case scenarios, Federal Labour Court, CR 2022, 437 para. 33; NJW 2021, 2379 para. 20). Contrary to the appellant’s view, the claim is not indefinite simply because it mentions only “data categories” without any limitation. The limitation arises from the fact that the plaintiff is only requesting copies of documents containing information about her. The fact that the period for which copies of documents are requested encompasses the entire long-standing business relationship between the parties does not—contrary to the appellant’s assertion—render the request vague.

2. The plaintiff is not entitled to the claimed right to copies of documents under Article 15(1) and (3) GDPR to the extent requested and granted by the Court of Appeal. However, she is entitled to copies of letters and emails she authored during the aforementioned period that are in the defendants’ possession.

a) The Court of Appeal correctly concluded that Article 15 GDPR is applicable with regard to the time frame. The General Data Protection Regulation (GDPR) also applies to processing operations carried out before May 25, 2018, the date of application of the GDPR (Article 99(2) GDPR), if the request for access was made after that date (see CJEU, Judgment of June 22, 2023 – C-579/21, NJW 2023, 2555, para. 36). According to the findings of the Court of Appeal, the plaintiff, by letter dated April 11, 2019, requested information from the defendants and copies of documents that had been generated by the defendants between January 1, 1997, and March 31, 2018.

b) Article 15(1) GDPR grants the data subject the right to obtain from the data controller (Article 4(7) GDPR) information about the processing of personal data concerning him or her. Article 15(3) GDPR lays down the practical modalities for fulfilling the data controller’s obligation by specifying, among other things, the form in which the personal data must be provided, namely in the form of a “copy” of the data, but does not grant any right other than that provided for in Article 15(1) GDPR (see CJEU, Judgment of 4 May 2023 – C-487/21, NJW 2023, 2253, paras. 31 et seq.). On this basis, the plaintiff is only entitled to receive copies of the letters and emails she wrote that are held by the defendants.

(aa) According to Article 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person (“data subject”). According to the case law of the Court of Justice of the European Union, this term is to be interpreted broadly. It is not limited to sensitive or private information, but potentially encompasses all types of information, both objective and subjective, provided that it relates to the person in question. This latter requirement is met if the information, by virtue of its content, purpose, or effect, is linked to a specific individual (see ECJ, Judgment of 4 May 2023 – C-487/21, NJW 2023, 2253, paras. 23 et seq.; Federal Court of Justice Judgment of 15 June 2021 – VI ZR 576/19, NJW 2021, 2726, para. 22 with further references).

According to these principles – as the Court of Appeal correctly assumed – letters from the data subject to the controller must be classified as personal data in their entirety, since the personal information already consists in the fact that the data subject has expressed themselves in accordance with the letter, whereas letters from the controller to the data subject only constitute personal data insofar as they contain information about the data subject according to the aforementioned criteria (see Federal Court of Justice judgments of 6 February 2024 – VI ZR 15/23, not yet published; of 15 June 2021 – VI ZR 576/19, NJW 2021, 2726 para. 25; Federal Court of Justice judgment of 27 September 2023 – IV ZR 177/22, NJW 2023, 3490 para. 48). The fact that the data subject is already aware of these letters does not preclude the right to information under data protection law (see Federal Court of Justice judgment of June 15, 2021 – VI ZR 576/19, NJW 2021, 2726, para. 25 with further references).

bb) With her application, granted by the Higher Regional Court, the plaintiff – as explained above – requests that she be provided with copies of telephone notes, file memos, meeting minutes, emails, letters, and subscription documents for investments containing the plaintiff’s personal data processed by the defendants. As explained in section aa), the letters and emails written by the plaintiff and available to the defendants do, in their entirety, constitute personal data, which is why the plaintiff can ultimately request a copy of these letters and emails pursuant to Article 15(3) GDPR, even though the term “copy” in this provision does not refer to a document as such, but to the personal data it contains (see ECJ, judgments of 26 October 2023 – C-307/22, NJW 2023, 3481, para. 72; of 4 May 2023 – C-487/21, NJW 2023, 2253, para. 32). The copy must contain all personal data that is the subject of the processing (ECJ, judgments of 26 October 2023 – C-307/22, NJW 2023, 3481, para. 73; of 4 May 2023 – C-487/21, NJW 2023, 2253, paras. 32, 39). The requirement of completeness of disclosure can only be met by providing a copy of the entire document.

In contrast, contrary to the opinion of the Court of Appeal, neither the defendant’s letters and emails, nor its telephone notes, file memos, or meeting minutes, nor even its subscription documents for investments necessarily constitute personal data of the plaintiff in their entirety, even if they contain information about the plaintiff. While it is conceivable that internal memos such as telephone notes or transcripts of conversations, which record how the plaintiff expressed herself by telephone or in person, contain exclusively information about the plaintiff, it cannot be assumed that this is the case in all instances. Therefore, the requirement to provide complete information about personal data does not give rise to a right for the plaintiff to receive copies of all such documents, as she has requested. While the reproduction of excerpts from documents, or even of entire documents or excerpts from databases, may prove indispensable regardless of the requirement to provide complete information, if contextualizing the processed data is necessary to ensure its comprehensibility and to guarantee the data subject’s effective exercise of their rights (see ECJ, judgments of 4 May 2023 – C-487/21, NJW 2023, 2253, paras. 41, 45; of 22 June 2023 – C-579/21, NJW 2023, 2555, para. 66; of 26 October 2023 – C-307/22, NJW 2023, 3481, paras. 74 et seq.; Federal Court of Justice judgment of 6 February 2024 – VI ZR 15/23, not published); (Federal Court of Justice (BGH), Judgment of September 27, 2023 – IV ZR 177/22, NJW 2023, 3490, para. 51 et seq.). However, the plaintiff has neither argued in the lower courts nor is it otherwise apparent that contextualizing the processed data is necessary to ensure its comprehensibility, such that, as an exception, the transmission of a copy of the requested telephone notes, file memos, meeting minutes, emails, and letters from the defendant, as well as subscription documents for investments, would be required.

c) Contrary to the plaintiff’s assertion during the appeal hearing, the claim granted by the Court of Appeals does not include, as a lesser measure, the alternative claim raised by the plaintiff during the appeal hearing, which seeks the provision of “copies” of the plaintiff’s personal data contained in the aforementioned documents. The plaintiff, in the application granted by the Court of Appeals, seeks the provision of copies of documents, regardless of whether a document contains the plaintiff’s personal data exclusively or even to a minor extent. According to this application, the plaintiff’s personal data is merely the criterion for identifying the documents for which the plaintiff requests a complete copy. In contrast, the alternative application raised in the appeal hearing, by its very wording, specifies that the personal data is the sole subject matter to be disclosed. The applications differ in the object of disclosure.

d) The Court of Appeals made no findings indicating that the plaintiff—as alleged by the appellant—is pursuing a purpose unrelated to data protection law with the asserted claim. Furthermore, according to the case law of the Court of Justice of the European Union, the controller is obligated to provide the data subject with a copy of their personal data undergoing processing, even if the request is for purposes other than those mentioned in Recital 63 of the GDPR (see CJEU, Judgment of 26 October 2023 – C-307/22, NJW 2023, 3481, paragraphs 38, 51 et seq.).

“ … 3. Insofar as the plaintiff raised for the first time in the appeal hearing the further alternative claim to be provided with copies of personal data contained in the aforementioned documents, this constitutes a subsequent joinder of claims (§ 260 of the German Code of Civil Procedure) and thus an amendment to the complaint (see Federal Labor Court, NZA 2016, 1232 para. 32; Federal Court of Justice, judgment of October 24, 1989 – X ZR 26/88, juris para. 23 with further references). Such an amendment is generally inadmissible in the appeal on points of law (see Senate judgment of December 14, 2020 – VI ZR 573/20, NJW-RR 2021, 187 para. 7 with further references). An exception is not applicable here, since a plaintiff can only raise a new claim in the appeal on points of law if they are the appellant. The mere filing of an appeal or cross-appeal gives the parties the opportunity to submit substantive motions. Filing an application outside the scope of the appeal already filed would circumvent the statutory provisions governing revision and cross-revision (see Federal Labor Court [BAG], NJW 2019, 3101 para. 17; NZA 2016, 1232 para. 31; NJW 2014, 2607 para. 12; Seiler in Thomas/Putzo, ZPO, 44th ed., § 559 para. 3; MüKoZPO/Becker-Eberhard, 6th ed., § 263 para. 45; Saenger/Saenger, ZPO, 10th ed., § 263 para. 12; for appeals on points of law, see Federal Court of Justice [BGH], judgment of May 7, 2015 – VII ZR 145/12, NJW 2015, 2812 para. 28).

III.
… The judgment of the appellate court is to be set aside to the aforementioned extent (§ 562 para. 1 of the German Code of Civil Procedure). The Senate can decide the matter itself, since the partial reversal of the judgment is based solely on an error of law in the application of the law to the established facts, and the case is ready for a final decision based on those facts (§ 563 para. 3 of the German Code of Civil Procedure).
</pre>

LAG Düsseldorf – 3 Sa 285/23

FTC to Host Virtual Workshop on January 28 on Age Verification Technologies