Lde: Created page with “{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=VG Düsseldorf |Court_Original_Name=Verwaltungsgericht Düsseldorf |Court_English_Name=Administrative Court Düsseldorf |Court_With_Country=VG Düsseldorf (Germany) |Case_Number_Name=29 K 9469/23 |ECLI= |Original_Source_Name_1=openjur |Original_Source_Link_1=https://openjur.de/u/2541967.html |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |O…”
|Jurisdiction=Germany
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=VG Düsseldorf
|Court_Original_Name=Verwaltungsgericht Düsseldorf
|Court_English_Name=Administrative Court Düsseldorf
|Court_With_Country=VG Düsseldorf (Germany)
|Case_Number_Name=29 K 9469/23
|ECLI=
|Original_Source_Name_1=openjur
|Original_Source_Link_1=https://openjur.de/u/2541967.html
|Original_Source_Language_1=German
|Original_Source_Language__Code_1=DE
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=
|Date_Decided=28.01.2026
|Date_Published=
|Year=2026
|GDPR_Article_1=Article 15 GDPR
|GDPR_Article_Link_1=Article 15 GDPR
|GDPR_Article_2=Article 15(3) GDPR
|GDPR_Article_Link_2=Article 15 GDPR#3
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_4=
|GDPR_Article_Link_4=
|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=
|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=
|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Appeal_From_Body=
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=
|Initial_Contributor=lde
|
}}
The court held that under [[Article 15 GDPR#3|Article 15(3) GDPR]] controllers may lawfully redact third-party data as long as the data subject’s information remains complete and understandable.
== English Summary ==
=== Facts ===
The data subject was subject to a home visit by the public health authority following an external report raising concerns about her condition. After the visit, the authority created internal medical notes and administrative records documenting observations made by a physician, as well as information about the person who had reported the situation.
The data subject subsequently requested access under [[Article 15 GDPR|Article 15 GDPR]] to all records held about her, including call logs, internal reports, medical notes, and any documents containing her name. The authority provided a GDPR response and later disclosed the entire file, but redacted personal data relating to authority staff and the reporting third party.
The data subject brought an action seeking full, unredacted disclosure, arguing that the records did not accurately reflect what had occurred during the home visit and that she was entitled to receive the documents in their entirety under the GDPR.
=== Holding ===
The court dismissed the claim, holding that the controller had fully complied with its obligations under [[Article 15 GDPR|Article 15 GDPR]]. It emphasised that the right of access and the right to obtain a copy under [[Article 15 GDPR#3|Article 15(3) GDPR]] concern only the data subject’s own personal data, not the documents or files as such in which those data appear.
Relying expressly on the CJEU’s judgment in C-487/21 (F.F. v Österreichische Datenschutzbehörde), the court recalled that the concept of a “copy” under [[Article 15 GDPR#3|Article 15(3) GDPR]] refers to a faithful reproduction of the personal data undergoing processing, not necessarily to a copy of the entire document containing them. The decisive criterion is whether the information provided enables the data subject to obtain a complete and accurate understanding of the personal data processed about them and to effectively exercise their GDPR rights, such as rectification, erasure, or restriction of processing.
The court further clarified, in line with the CJEU’s reasoning, that the controller is entitled to redact information in the same document that does not relate to the data subject, including personal data of third parties. Such redactions are lawful provided that they do not distort or render unintelligible the data subject’s own personal data or the context in which those data are processed. The court thus found that the redactions made by the authority were permissible and did not undermine the substance of the access right, as the disclosed records still allowed the data subject to understand the purpose, context, and use of her personal data.
Finally, the court stressed that [[Article 15 GDPR|Article 15 GDPR]] does not provide a mechanism to contest the factual accuracy or substantive correctness of administrative or medical assessments. Disagreements about the content of reports must be pursued through other legal remedies and cannot be resolved through the GDPR right of access.
== Comment ==
”Share your comments here!”
== Further Resources ==
”Share blogs or news articles here!”
== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.
<pre>
Since the right to a copy of data is limited to the personal data of the data subject, the controller is entitled to redact data unrelated to the data subject that is contained in the same document or file before providing the copy.
Judgment
The action is dismissed.
The plaintiff shall bear the costs of the proceedings.
This judgment is provisionally enforceable with respect to costs. The plaintiff may avert enforcement by providing security in the amount of 110% of the amount enforceable under this judgment, unless the defendant provides security in the amount of 110% of the amount to be enforced before enforcement is carried out.
Facts of the Case
By letter dated April 16, 2023, subject line “Home visit by Mr. N. and Dr. W. on March 30 at my residence, Ref. No. 00/00,” the plaintiff requested access to the transcripts of the phone call from Ms. J. C. and the conversation with the aforementioned gentlemen from the defendant.
By letter to the defendant dated November 13, 2023, received on November 20, 2023, the plaintiff, represented by her then-attorney, requested information about the results of her expert assessment. She also requested information regarding data protection.
On December 28, 2023, the plaintiff filed a lawsuit seeking full disclosure regarding data protection. She asserts that the defendant did not respond within the one-month deadline. On December 18, 2023, the defendant called and requested an extension. No specific deadline was stated.
On February 27, 2024, the defendant provided information regarding data protection. To the extent that the request for information went beyond the scope of the information provided, the defendant rejected the request, citing the North Rhine-Westphalia Health Data Protection Act. The defendant explained that, according to Mr. Q., the responsible neurologist in the social psychiatric service of the public health department, disclosing medical findings, diagnoses, and other text documents would lead to a disproportionate deterioration of the plaintiff’s general health.
By letter dated June 21, 2024, the defendant provided the plaintiff’s file, partially redacted. In addition to the names, office addresses, and telephone numbers of government employees, the information about the reporting person and the notes on observations made by the responsible specialist during the home visit to the plaintiff were also redacted.
By letter dated December 23, 2025, the defendant finally forwarded the memorandum dated March 28, 2023, from the responsible specialist following his home visit to the plaintiff, with the personal data of the reporting individual redacted.
In support of her claim, the plaintiff further states that she continues to insist on receiving the complete and unredacted files from the public health department. Nothing in the memorandum corresponds to what transpired between Mr. Q. and her on March 30, 2023.
In her written submission of December 28, 2023, the plaintiff requests that
the defendant be ordered to provide complete data protection information, consisting in detail of:
the categories of personal data processed by the defendant, e.g., master data, social security characteristics, tax-relevant characteristics, sensitive data within the meaning of Article 9 GDPR (such as health data),
the purposes of the processing,
the recipients or categories of recipients to whom the personal data have been or will be disclosed, e.g., collection agencies, authorities, or other bodies,
the planned duration of storage of the personal data concerning the plaintiff, or, if this is not possible, the criteria used to determine that duration,
the existence of a right to rectification or erasure of the personal data concerning the plaintiff or to restriction of processing by the defendant as the controller or a right to object to such processing,
the existence of a right to lodge a complaint with a supervisory authority,
if the personal data are not stored with the The following information has been collected from the plaintiff as a data subject: All available information about the origin of the data,
Submission of all text documents stored about the plaintiff, in particular decisions issued against the plaintiff – but also text documents from third parties – especially the judiciary and courts (specifically criminal judgments),
Where applicable, the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR, as well as meaningful information about the logic involved and the scope and intended effects of such processing for the plaintiff as a data subject,
All documents stored by the defendant that contain the plaintiff’s name.
The defendant requests that
the action be dismissed.
In support of this request, the defendant argues, in essence, that it has largely complied with the plaintiff’s request by providing the data protection information, making available the file concerning the plaintiff, and sending the memorandum dated March 28, 2023. The remaining redactions in the file note contain personal data relating to the reporting person and will be retained. No further letters or documents exist.
The parties have declared their consent to a decision without oral proceedings, the defendant by letter dated November 29, 2024, and the plaintiff by letter dated December 11, 2024.
For further details of the facts and the legal arguments, reference is made to the contents of the court file and the administrative file.
Reasons
The action, which can be decided without oral proceedings with the consent of the parties (Section 101 Paragraph 2 of the Code of Administrative Court Procedure (VwGO)), is unsuccessful. It is inadmissible.
The plaintiff’s action for performance, which she maintains in full despite the court’s notice of November 20, 2025, pursuant to Section 113 Paragraph 5 Sentence 1 of the German Code of Administrative Procedure (VwGO), lacks the necessary legal interest because the requested information has since been provided.
The defendant has satisfied the plaintiff’s request for information by providing the data protection information dated February 27, 2024, pursuant to Article 15 of the General Data Protection Regulation (GDPR), as requested in points 1-7 and 9 of the statement of claim. Furthermore, the defendant has complied with the plaintiff’s request for the transmission of all text documents stored about her or containing her name (points 8 and 10 of the statement of claim) by initially partially granting access to the plaintiff’s partially redacted file and ultimately fully by sending the partially redacted file note dated March 28, 2023, from the responsible specialist following his home visit to the plaintiff. Since the defendant proactively sent the plaintiff a copy of the entire file concerning the plaintiff in response to her request for information, the disputed question of whether the right to a copy of data under Article 15(3) GDPR is strictly limited to the disclosure of personal data or whether the entire document or file is to be considered as covered by paragraph 3,
see for a detailed discussion of the legal debate: Schmidt-Wudy, in: BeckOK Datenschutzrecht, Wolff/Brink/v. Ungern-Sternberg, 54th edition, as of November 1, 2025, Article 15, para. 85,
needs not be decided here.
There is no concrete evidence that the information was not provided in full. Against this background, there is no longer any legitimate interest in compelling the defendant to comply with the plaintiff’s claim.
The fact that, in the plaintiff’s opinion, Dr. Q. misrepresented the home visit in the file note is irrelevant. The data subject’s right of access under Article 15 GDPR only constitutes a right to access all personal data of the data subject. Anything else, in particular any potential substantive correction, is not the subject of this action.
The plaintiff’s right of access under Article 15(1) GDPR and the associated right to a copy of the data under Article 15(3) GDPR have been fully complied with by the defendant, even considering that the personal data of the public officials and the reporting person were redacted in the documents provided.
The right under Article 15(3) GDPR includes a copy of the data relating to the data subject. The term “copy” refers not to a document as such, but to the personal data it contains, which must be complete.
See CJEU, Judgment of 4 May 2023 – C-487/21 –, EuZW 2023, 575, para. 32.
The copy must contain all personal data that are the subject of the processing. Crucially, the data subject must have a complete and unaltered understanding of the data processed about them by the controller, based on the information provided. The copy to be provided pursuant to Article 15(3), first sentence, GDPR must contain all the features necessary to enable the data subject to effectively exercise their rights under this Regulation, such as the right to rectification, the right to erasure, and the right to restriction of processing (Articles 16 to 18 GDPR). It must therefore reproduce this data completely and accurately.
See CJEU, Judgment of 4 May 2023 – C-487/21 –, EuZW 2023, 575, para. 39.
It should be noted, however, that the data subject’s right is limited to a copy of the personal data concerning them. The controller is therefore entitled to redact data unrelated to the data subject that is contained in the same document or file before providing the copy. This may be done, for example, by partially redacting text. However, such redaction must not shorten or distort the data relating to the data subject.
See Bäcker, in: Kühling/Buchner, GDPR, 4th ed. 2024, Art. 15 para. 40d.
The redactions made by the defendant relate exclusively to the personal data of the officials involved in the case and the reporting person. Otherwise, the documents are complete. The redactions do not diminish or distort the information contained in the documents issued, which include the plaintiff’s personal data. In particular, the copies of the documents provided, despite the redactions, still clearly show the context in which the plaintiff’s personal data is being used.
See Dix, in: Simitis/Hornung/Spiecker gen. Döhmann, Data Protection Law, 2nd ed. 2025, Art. 15 para. 28 with further references.
The decision on costs is based on Section 154 para. 1 of the Code of Administrative Court Procedure. The cost provision of Section 161 Paragraph 3 of the German Code of Administrative Procedure (VwGO), according to which, in cases of (the present case) an action for failure to act pursuant to Section 75 VwGO, the costs are borne by the defendant if the plaintiff could have expected a decision before filing the action, does not apply to the plaintiff. Regardless of whether the plaintiff could have expected a decision on her request for information, submitted on November 20, 2023, before filing the action on December 28, 2023, the connection between the defendant’s default and the cost-incurring litigation was severed because the plaintiff continued the proceedings despite the fulfillment of her claim. She no longer requires cost protection for the further course of the proceedings on her own initiative.
… See Neumann/Schaks, in: Sodan/Ziekow, VwGO, 5th ed., § 161 para. 219.
The decision regarding provisional enforceability is based on § 167 para. 1 VwGO in conjunction with §§ 708 no. 11, 709 sentence 2, 711 of the Code of Civil Procedure.
Instructions on Appeal
Within one month of service of this judgment, a written application may be filed with the Düsseldorf Administrative Court requesting that the Higher Administrative Court for the State of North Rhine-Westphalia in Münster grant leave to appeal. The application must identify the judgment being appealed.
Within two months of service of the judgment, the grounds for granting leave to appeal must be stated. The statement of grounds, unless already submitted with the application, must be filed in writing with the Higher Administrative Court for the State of North Rhine-Westphalia in Münster.
The application must be filed and substantiated by a lawyer or a professor of law at a state or state-recognized university in a Member State of the European Union, another Contracting State of the Agreement on the European Economic Area, or Switzerland, who is qualified to hold judicial office, or by a person of equivalent status acting as their authorized representative. Public authorities and legal entities under public law, including associations formed by them to fulfill public tasks, may also be represented by their own employees qualified to hold judicial office or by employees qualified to hold judicial office of other public authorities or legal entities under public law, including associations formed by them to fulfill their public tasks. Attention is drawn to the special provisions in Section 67, Paragraph 4, Sentences 7 and 8 of the Code of Administrative Court Procedure (VwGO).
Decision
The value in dispute is set at
€5,000.
Reasons:
The determination of the value in dispute is based on Section 52, Paragraph 2 of the Court Costs Act (GKG). The set value corresponds to the standard value in dispute.
Legal Remedies
An appeal against this decision may be filed in writing or recorded by the clerk of the court at the Düsseldorf Administrative Court within six months of the decision in the main proceedings becoming final or the proceedings otherwise being concluded. The Higher Administrative Court for the State of North Rhine-Westphalia in Münster will decide on the appeal if the Administrative Court does not grant relief. If the amount in dispute is determined less than one month before the expiry of the aforementioned period, the appeal may be filed within one month of service or informal notification of the order determining the amount in dispute. The appeal is only admissible if the value of the subject matter of the appeal exceeds two hundred euros. An appeal is also admissible if the court that issued the decision grants leave to appeal due to the fundamental importance of the question at issue.
If the court that issued the decision grants leave to appeal, the appeal is admissible due to the fundamental importance of the issue to be decided.
If the amount in dispute is determined less than one month before the expiry of the aforementioned period, the appeal may be filed within one month of service or informal notification of the order determining the amount in dispute.
</pre>