The Case: Tax Office Denies Data Access Due to Effort
A claimant requested full access to their stored personal data from the tax office under Article 15 GDPR, including copies of all data. The office only provided a summary and offered file inspection, refusing full copies due to “disproportionate effort.” The case ended up before the BFH.The Ruling: GDPR Right of Access Applies Without Exception
The BFH ruled in favor of the claimant. Authorities and companies may not rely on “disproportionate effort” to avoid GDPR obligations. The regulation does not recognize this as a valid refusal reason. Even if the request is extensive, it cannot be denied solely for being “excessive.”Key Arguments from the BFH:
- No Analogous Use of Art. 14(5)(b) Alt. 2 GDPR: The exception due to disproportionate effort only applies to the information obligation under Article 14, not to the access right under Article 15.
- No General Proportionality Clause: The right of access applies regardless of the effort involved for the data controller.
What Does This Mean for Companies? Implement the GDPR Access Right!
This ruling has serious implications for GDPR practices:- Comprehensive Right of Access: Data subjects are entitled to full access to their data. Company workload doesn’t matter.
- No More Excuses: “Disproportionate effort” is no longer an acceptable justification for refusing access.
- Ensure GDPR Compliance: Companies must structure their processes to comply with GDPR and handle access requests efficiently. Don’t ignore GDPR access rights!
Disproportionate Effort & GDPR: FAQ
What is “disproportionate effort” under GDPR?
It’s not clearly defined, but the BFH makes it clear: it’s not a valid reason to refuse access.
How can I implement the GDPR access right efficiently?
Invest in the right software and workflows to process data access requests quickly and completely.
Where can I find more information on the GDPR access right?
Check the official website of the European Commission or consult a specialized data protection lawyer.
