VG München - M 26a K 25.5210
Facts — The data subject had been liable to pay broadcasting contributions to the Controller, a German regional public broadcasting authority, since 2007. Following objections to several contribution assessment notices, the data subject submitted a request under Article 15 GDPR seeking a copy of all personal data processed about him by the Controller. The Controller responded by providing the categories of personal data and related information specified under § 11(8) of the German Broadcasting Contribution Treaty (RBStV), which governs data subject access requests relating to broadcasting contribution records, together with general privacy information. The data subject argued that the response was incomplete because it did not include copies of all documents containing his personal data, including correspondence with him and third parties. The Controller maintained that it had fully complied with its obligations under the RBStV. After the Controller declined to provide additional information, the data subject brought proceedings seeking disclosure of all personal data concerning him processed by the Controller. Holding — The Court held that § 11(8) of the German Broadcasting Contribution Treaty (RBStV) constituted a lawful restriction of the broader right of access under Article 15 GDPR pursuant to Article 23(1)(e) GDPR. It found that the national provision was a valid legislative measure, respected the essence of the fundamental right to data protection, and pursued an important public interest by ensuring the effective financing and administration of the public broadcasting system. The Court further held that the restriction was necessary and proportionate, noting that requiring the Controller to comply with the full scope of Article 15 GDPR across more than 44 million broadcasting contribution accounts would impose a disproportionate administrative and financial burden capable of undermining that public interest. The Court also held that § 11(8) RBStV satisfied the safeguards required under Article 23(2) GDPR by specifying the purposes of processing, categories of personal data, scope of the restriction, safeguards against misuse and unlawful access, the identity of the Controller, applicable storage periods and other statutory protections. Accordingly, while the Controller was required to disclose the categories of information specified under § 11(8) RBStV, it was not required to provide a copy of all personal data processed under Article 15(3) GDPR. As the Controller had already provided all information required under the national provision, the court dismissed the action.
How it connects
Related across sources
Full text
Administrative Court of Munich, Judgment of May 18, 2026 – M 26a K 25.5210 Title: Broadcasting fee, request for data disclosure, leave to appeal due to fundamental importance of the case, action for performance, right to information, data protection, proportionality, obligation to refer Legal basis: GDPR Art. 15 GDPR Art. 23 para. 1 letter e) GDPR Art. 23 para. 2 RBStV Art. 11 para. 8 VwGO § 124a para. 1 sentence 1 VwGO § 124 para. 2 no. 3 Keywords: Broadcasting fee, request for data disclosure, leave to appeal due to fundamental importance of the case, action for performance, right to information, data protection, proportionality, obligation to refer Judgment I. The action is dismissed. II. The plaintiff shall bear the costs of the proceedings. III. The cost decision is provisionally enforceable. The plaintiff may avert enforcement by providing security or depositing the amount due, unless the defendant provides security in the same amount beforehand. IV. Leave to appeal is granted. Statement of Facts 1. The plaintiff, who since 2007 has been charged by the defendant under contribution number … … … initially for payment of broadcasting fees, and since 2013 for payment of broadcasting contributions for an apartment at T. Street 50 in …, requests a copy from the defendant of the personal data concerning him that is being processed by the defendant. 2 On July 3, 2024, and August 13, 2024, the plaintiff filed objections against the defendant's assessment notices dated June 3, 2024, and August 1, 2024, and simultaneously requested, under the heading "Data Protection Inquiry," information on which service providers the "Contribution Service" collaborates with and subsequently a copy of the "Contribution Service's" data processing agreement with its IT service providers in accordance with the General Data Protection Regulation (GDPR). The plaintiff argued that the defendant was using a complex process of comparing his data with the residents' registration office, thereby infringing on his privacy, and was transmitting this data to third parties without informing him. He insisted that it be ensured that data protection requirements were being met. ... 3 By letter dated November 27, 2024, the plaintiff combined his objection to a further assessment notice dated November 1, 2024, with an objection to the automated processing of his data pursuant to Article 22(1) GDPR, a data protection-related cease and desist order, and a request for access to his data pursuant to Article 15(1) GDPR. The defendant had evidently transmitted personal data about him to a non-legal entity, “ARD ZDF Deutschlandradio Contribution Service,” which is why he was contacting the defendant out of serious data protection concerns. He demanded that the defendant send him current and complete information about his personal data processed by the defendant and, referring to Article 15(3) GDPR, also requested that he be provided with a copy in machine-readable form free of charge. The personal data in question comprised all documents containing his name or otherwise capable of identifying him. This would include, for example, all documents, emails, notifications from the residents' registration office, etc., that would make him identifiable. No deadline for providing the information is set, as this already arises from Article 12(3) GDPR. The information must be provided in full. 4. By letter dated November 29, 2024, the defendant confirmed that the state broadcasting corporation responsible for the plaintiff (controller within the meaning of the GDPR) processes personal data through the Contribution Service under the contribution number … … … . The state broadcasting corporations, ZDF, and Deutschlandradio jointly operate the Contribution Service within the framework of a non-legal entity public-law administrative association, pursuant to Section 10(7) of the Interstate Broadcasting Contribution Agreement (RBStV). According to the agreement of the joint controllers (Article 26 GDPR), the information is provided by the Contribution Service. At the same time, the content of Section 11 Paragraph 8 of the RBStV (German Interstate Broadcasting Treaty) was reproduced. The letter included general data protection information as Appendix 1, which contained general statements on the origin of the data, the categories of personal data being processed, the purposes of data processing, the recipients of data, the storage period or the criteria for determining this period, the rights of the data subject, and the existence of automated decision-making, including profiling. Furthermore, attached as Appendix 2 was a data disclosure document designated as a copy of the data specified in Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV), which listed the plaintiff's contribution number, his current address, his date of birth, the collection of the broadcasting contribution in the private sector, Bayerischer Rundfunk as the responsible broadcasting corporation, bank transfer as the payment method, the payment frequency as stipulated by law (in the middle of a three-month period), the currently used bank account details for received transfers, and the last address of the contribution debtor reported to the defendant. 5 In a further letter dated December 4, 2024, the Contribution Service supplemented the plaintiff's argument that the responsible regional broadcasting corporation not only processed personal data itself, but also had it processed by the Contribution Service of ARD, ZDF, and Deutschlandradio, which is not a legal entity and therefore the data processing is unlawful. The Contribution Service explained that when the Contribution Service is commissioned as a joint body of all regional broadcasting corporations pursuant to Section 10 Paragraph 7 of the Interstate Broadcasting Treaty (RBStV), Section 11 Paragraph 2 of the RBStV always constitutes internal data processing by the respective regional broadcasting corporation, and therefore all regulations relating to processing by third parties do not apply. 6 In a letter dated February 19, 2025, the plaintiff pointed out to the defendant that the data disclosure was incomplete, as it also required the provision of a copy of the personal data being processed. This means that the data subject will be provided with a true and comprehensible reproduction of all this data, in particular all correspondence with him (including documents he has sent to the defendant) as well as correspondence between the defendant and third parties (including his lawyers, enforcement agencies, courts, registration authorities, Deutsche Post AG, etc.) relating to him. 7 After the plaintiff had also combined his objection of February 16, 2025, against the assessment notice of February 3, 2025, with an objection to automated data processing pursuant to Article 22, paragraph 1 of the GDPR, a data protection injunction, and a request for access to data pursuant to Article 15, paragraph 1 of the GDPR, the defendant, in a letter from the Broadcasting Fee Collection Service dated February 20, 2025, provided the plaintiff with the same information as already contained in the letters of November 29, 2024, and December 4, 2024. 8 In a letter from the Broadcasting Fee Collection Service dated February 21, 2025, the defendant stated that all legally required information had been provided in full. The content of the information to be provided was specifically regulated in Section 11, paragraph 8 of the Interstate Broadcasting Treaty. The matter was therefore considered closed. 9 By letter dated February 19, 2025, received by the court on August 13, 2025, the plaintiff filed a lawsuit with the request, last made at the oral hearing on May 18, 2026, 10 that the defendant be ordered to provide the plaintiff with a copy of all personal data concerning him that is being processed by the defendant. 11 The lawsuit is admissible; in particular, the claim is sufficiently specific, and a limitation by reference to partial disclosures already provided is not procedurally mandatory. The lawsuit is also fully founded; the asserted claim follows directly from Article 15 GDPR. A violation has occurred because the defendant has not provided the requested copies. Data disclosure without a copy pursuant to Article 15(3) GDPR is incomplete. The amount in dispute was stated as EUR 500.00, since no commercial objectives are being pursued. The Federal Court of Justice ruled in its judgment of January 28, 2025 (Case No. VI ZR 183/22) that a premature entry in the Schufa credit report without a legally enforceable claim constitutes a violation of the GDPR, which is to be compensated with €500.00 in non-material damages. This judgment is considered groundbreaking, as the facts of the case are comparable to many cases concerning the broadcasting fee collection service. 12 requested that By letters dated October 9, 2025, and October 13, 2025, the defendant submitted the administrative file and that 13 the action be dismissed. 14 The grounds for this were that the defendant had already fulfilled the plaintiff's request for information of November 27, 2024, with the information provided on November 29, 2024, and December 4, 2024. Whether the defendant was even required to respond to the renewed request for information dated February 19, 2025, or whether he could have refused to provide the information analogously to Article 12(5), second sentence, letter b) of the GDPR, is irrelevant, since he provided information again on February 20, 2025. The fact that the defendant did so through the Contribution Service, which acts as an administrative assistant, does not affect the validity of the information provided. According to Section 10(7), first sentence, of the Interstate Broadcasting Treaty (RBStV), the defendant performs the assigned tasks and the associated rights and obligations wholly or partly through the Contribution Service. The regional broadcasting corporations, ZDF, and Deutschlandradio are jointly responsible for fulfilling data protection obligations within the meaning of Article 4, No. 7 of the GDPR (Article 26 of the GDPR). The data processing at the Contribution Service constitutes data processing by the respective state broadcasting corporation, which is responsible for collecting the contribution according to the Interstate Broadcasting Treaty (RBStV). ZDF and Deutschlandradio have no access to the data processing at the Contribution Service. The Contribution Service is the central contact point within the meaning of Article 26 Paragraph 1 Sentence 3 GDPR. 15 Any potential right to information is not governed by Article 15 GDPR, but by the broadcasting-specific regulation in Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV) in conjunction with Section 8 Paragraph 4 RBStV. The explanatory memorandum to the Act (BayLT-Drs. 17/19793, p. 15) states: “Those liable for the broadcasting fee continue to have only the information and disclosure rights regulated in the Interstate Broadcasting Fee Treaty.” The legislator enacted Section 11 Paragraph 8 RBStV on the basis of the opening clause in Article 23 Paragraph 1 Letter e) GDPR. The fulfillment of the constitutional mandate of public broadcasting is a task in the general public interest. Accordingly, the proper functioning of broadcasting and its administration is also in the public interest. Since a functioning mass administration procedure must be ensured with regard to the collection of broadcasting fees, the legislator has regulated the data protection transparency obligations in a practical manner. In this regard, the Bavarian State Parliament (BayLT-Drs. 17/19793, p. 16) stated the following in its approval of the amendment to the Interstate Broadcasting Treaty: "The provisions of the Interstate Broadcasting Treaty constitute a suitable restriction pursuant to Article 23(1)(e) of the General Data Protection Regulation (GDPR). The necessary balancing of interests with regard to the affected legal positions was already required by the state legislature under the previously applicable legal framework. This balancing decision was carried out again in light of the provisions of the GDPR. With over 44 million contribution accounts, the extensive disclosure obligations of the GDPR are particularly likely to jeopardize the objective of data processing. The processed data serves to ensure the proper financial resources of public broadcasting. The administrative and financial burden required to fulfill the requests for information would counteract this objective and is disproportionate to the protection of the interests of the data subjects. This is all the more true given that extensive information Regarding the type, scope, and origin of the data, as well as the duration of its processing, the legal basis already makes clear, and every contributor receives a registration confirmation with the data required for the collection of contributions pursuant to paragraph 6.” Reference was also made to a judgment issued by the Schleswig-Holstein Administrative Court on September 25, 2025, 6 A 70/25, in a comparable case, which was quoted in part. The legal situation is identical in Bavaria and is also judged identically (final judgment of the Aichach Local Court of June 30, 2023, 103 C 490/22). 16 By letter dated October 22, 2025, the plaintiff requested that the proceedings be stayed pursuant to Section 94 of the Code of Administrative Court Procedure (VwGO) until the Bavarian Higher Administrative Court renders a final and binding decision in the proceedings remanded by the Federal Administrative Court by judgment of October 15, 2025 (BVerwG 6 C 12.24), or, in the alternative, that the proceedings be referred to the Court of Justice of the European Union pursuant to Article 267 TFEU for a preliminary ruling on the following question (whether Article 23(1)(e) and (2) GDPR precludes the national provision of Section 11(8) of the Interstate Broadcasting Treaty (RBStV) in its current version, insofar as it restricts the right to information in a blanket manner and without sufficient legal safeguards) and, in the further alternative, that the defendant's disclosure at issue be declared incomplete and that the defendant be ordered to submit the complete personal data, including all internal and external correspondence. The Federal Administrative Court clarified in its judgment of October 15, 2025, that Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV) requires an interpretation that is consistent with the constitution and EU law. It specifically objected that the provision does not contain specific safeguards against abuse within the meaning of Article 23 Paragraph 2 Letters d)-h) of the GDPR, that neither the scope nor the duration of the restriction is clearly defined, and that, consequently, the restriction of the right to information alleged by the defendant may be insufficiently specific and disproportionate. The Federal Administrative Court referred the case back to the Bavarian Higher Administrative Court for further review of the facts and the legal provision. Since this decision directly concerns the same legal question as the present proceedings, uniform application of the law can only be ensured by a stay of proceedings pending a decision by the Bavarian Higher Administrative Court. A preliminary ruling request to the ECJ is necessary in the alternative to clarify the validity under EU law of the national restriction pursuant to Article 23 GDPR. Judicial guidance is requested. 17 In a letter dated April 15, 2026, the plaintiff referred to a decision of the German Federal Court of Justice (BGH) of February 25, 2026, VII ZB 29/24, according to which the responsible person must be identifiable from the signature when transmitting a document using a special electronic mailbox for public authorities as a secure transmission channel. To comply with the formal requirements of Section 130a(3), sentence 1 of the German Code of Civil Procedure (ZPO), it is not sufficient if an electronic document is simply signed with the name of a person who is not responsible for its content. At the same time, regarding the issue of incomplete data disclosure, he referred to a judgment of the Federal Court of Justice (BGH) of March 9, 2026, VI ZR 335/24, concerning the right to information under Section 84a Paragraph 1 of the German Medicines Act. Furthermore, evidence would be presented to the court showing that identical text modules were being used in parallel proceedings (including before the Administrative Court of Darmstadt) to counter the BGH's case law. The plaintiff preemptively alleged a violation of the right to be heard (Article 103 of the German Basic Law) should the court disregard these new, decisive rulings of the highest court without individual review in the present case. In addition, it was requested that the defendant be ordered, within the framework of the secondary burden of proof, to disclose the technical logs for the creation of the contested decisions, including the personal signature records. In light of the present supplementary written submission and its attachments, as well as the further factual and legal considerations outlined therein, it was also suggested that the hearing scheduled for May 18, 2026, be cancelled or postponed to allow the parties and the court sufficient time to examine the supplementary submissions. Alternatively, it was suggested that the proceedings be suspended temporarily if the court does not yet consider the matter ready for a decision in view of parallel pending proceedings with implications relating to data protection law and broadcasting fees. 18 By letter dated May 12, 2026, the defendant, at the court's request, submitted the judgment of the Schleswig-Holstein Administrative Court of September 25, 2025, 6 A 70/25, cited in the statement of defense, and the judgment of the Aichach Local Court of June 20, 2023, 103 C 490/22. 19 The administrative dispute was heard orally on May 18, 2026. 20 For details of the facts, reference is made to the court file, in particular the minutes of the oral hearing of May 18, 2026, and the submitted administrative file. Reasons for the Decision 21 The admissible action is unfounded and was therefore to be dismissed. Due to the fundamental importance of the case, leave to appeal was granted. 22 1. The action is admissible. The court considers the action, as a general performance action, to be admissible, since the plaintiff's request is directed at the defendant taking action in the form of a factual act (provision of the copies). To the extent that case law holds that an action for the provision of copies of personal data pursuant to Article 15(3) GDPR is admissible as an action for performance, since the authority must decide by administrative act on the basis of a statutory review program, which relates in particular to possible grounds for exclusion or restriction, this view is not convincing, as every official act is likely to be preceded by a review program, so that there would then be no room for a general action for performance (see in detail the state of the opinion in BFH, judgment of 12 March 2024 – IX R 35/21 – BFHE 283, 266 – juris para. 12 with further references, for an action for performance BVerwG, judgment of 30 November 2022 – 6 C 10.21, BVerwGE 177, 211 – juris para. 14, also with regard to the assertion of a right to information under Art. 15 para. 1 GDPR (Federal Administrative Court, judgment of 16 September 2020 – 6 C 10.19 – juris para. 12, contra Federal Administrative Court, judgment of 20 August 2003 – 8 C 13.02 – juris para. 14: An action for information is a general performance action aimed at the performance of an official act). 23 The plaintiff's standing to sue is also established by the addition of the words "concerning him" to the statement of claim, which was last made by the plaintiff in the oral hearing of 18 May 2026 (§ 42 para. 2 VwGO). The plaintiff's right to sue is also established by the addition of the words "concerning him" to the statement of claim in the oral hearing of 18 May 2026 (§ 42 para. 2 VwGO). 24 Furthermore, the plaintiff also contacted the defendant with his request before filing the lawsuit, so that the general need for legal protection required for a general performance action exists. The generally existing possibility of contacting the data protection supervisory authority if the request for information is not fulfilled by the responsible broadcasting corporation or the contribution service (Beck RundfunkR/Herb, 5th ed. 2024, RBeitrStV § 11 para. 94, beckonline) does not eliminate the need for legal protection for a lawsuit filed alongside or as an alternative. 25 2. However, the lawsuit is unfounded because the plaintiff has no right to demand that the defendant provide him with a copy of all personal data concerning him that is being processed by the defendant. 26 2.1. The legal basis for a claim for information against the defendant is Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV), according to which every natural person has the right to request information from the regional broadcasting corporation responsible for them or the body established pursuant to Section 10 Paragraph 7 RBStV regarding the personal data concerning them listed in Section 8 Paragraph 4 RBStV, the existence, reason, and duration of any exemption or reduction concerning them within the meaning of Sections 4 and 4a RBStV, their bank account details, and the body that transmitted the respective data. Data that is stored only because it may not be deleted due to statutory or regulatory retention requirements or serves exclusively for data backup or data protection control purposes is not covered by the right to information under data protection law. 27 2.2. This provision lawfully restricts the broader right of access under Article 15 of the General Data Protection Regulation (GDPR), which includes, in particular, the requirement that the controller provide a copy of the personal data undergoing processing free of charge (Article 15(3), first sentence, in conjunction with Article 12(5), first sentence, GDPR), on the basis of Article 23(1)(e) and (2) GDPR. 28 Pursuant to Article 23(1)(e) GDPR, Union or Member State law to which the controller or processor is subject may restrict the obligations and rights, inter alia, under Article 15 GDPR by way of legislative measures, provided that such restriction respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society, safeguarding other important objectives of the general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, such as in the areas of monetary policy, budgetary policy, fiscal policy, public health, and social security. Article 23(2) GDPR lays down further requirements for the restrictions under Article 23(1) GDPR. 29 (1) Section 11 paragraph 8 of the Interstate Broadcasting Treaty (RBStV) as amended by the 23rd Interstate Broadcasting Treaty Amendment, which the Bavarian State Parliament approved by resolution of March 19, 2020 (Parliamentary Document 18/6982) and which, by publication of April 23, 2020 (Official Gazette, p. 262), has the force of law within the state with the status of a formal law (see Lindner/Möstl/Wolff/Möstl, 2nd ed. 2017, BV Art. 72 para. 13, beckonline), constitutes a valid legal provision within the meaning of Article 23 paragraph 1 letter e) GDPR. 30 (2) In light of the data listed in Section 8 paragraph 4 of the Interstate Broadcasting Treaty, which forms the basis of the right of access under Section 11 paragraph 8 sentence 1 no. 1 In conjunction with Section 8 Paragraph 4 of the Interstate Broadcasting Treaty (RBStV), this restriction also respects the essential content of the fundamental right to the protection of personal data and to information about data collected concerning a person, which is also guaranteed in Article 8 of the EU Charter of Fundamental Rights. 31 (3) The restriction also constitutes a necessary and proportionate measure that ensures the protection of other important objectives of the general interest of the Federal Republic of Germany, in particular an important economic or financial interest. 32 An interest is defined as one that affects or is shared by the general public. The general public interest encompasses all the common good interests of the Union and the Member States themselves. The question of weight can be assessed largely by the Union or the Member States themselves (BeckOK DatenschutzR/Stender-Vorwachs/Wolff/von Ungern- Sternberg, 55th ed. 1.2.2026, GDPR Art. 23 para. 35, beckonline). 33 The data processed under broadcasting law serves to ensure the adequate financial resources of public broadcasting. The interest in the adequate financial resources of public broadcasting is general within the meaning of the provision, as at least 44 million contribution accounts are affected. This objective of adequate financial resources would be jeopardized if the extensive disclosure obligations under the GDPR had to be fulfilled (see also Schleswig-Holstein Administrative Court, judgment of 25 September 2025 – 6 A 70/25 – not published, p. 7). These considerations, which the adjudicating court endorses, also formed the basis of the State Government's application for the Bavarian State Parliament's approval of the 21st Interstate Broadcasting Treaty (LT-Drs. 17/19793, p. 16), which were referenced in the State Government's application for the Bavarian State Parliament's approval of the 23rd Interstate Broadcasting Treaty (LT-Drs. 18/4703, pp. 9-10), which amended Section 11 Paragraph 8 of the Interstate Broadcasting Treaty, and which the defendant detailed in its statement of defense dated October 9, 2025. Rightly, the defendant's representative also pointed out in the oral hearing of May 18, 2026, that the considerable costs and administrative burden associated with an obligation to send a free copy of all documents recorded in the contribution account would ultimately jeopardize the stability of the contribution or lead to an increase in the broadcasting contribution. 34 (4) Section 11(8) of the Interstate Broadcasting Treaty also fulfills the further requirements for a permissible restriction under Article 23(2) of the GDPR. Subsequently, every legislative measure within the meaning of Article 23(1) GDPR must, in particular, where appropriate, contain specific provisions at least with regard to: a) the purposes of the processing or the categories of processing; b) the categories of personal data; c) the scope of the restrictions imposed; d) the safeguards against misuse or unlawful access or disclosure; e) the details of the controller or categories of controllers; f) the respective retention periods and the applicable safeguards, taking into account the nature, scope, and purposes of the processing or the categories of processing; g) the risks to the rights and freedoms of data subjects; and h) the right of data subjects to be informed about the restriction, provided that this is not detrimental to the purpose of the restriction. 35 a) The purposes of the processing or the categories of processing are specified in Section 11(4), sentence 1, of the RBStV, namely the processing of personal data for the purpose of collecting contributions and determining whether a contribution obligation exists. Section 36 Paragraph 4 RBStV. ``` b) The categories of personal data are derived from Section 11 Paragraph 8 Sentence 1 of the Interstate Broadcasting Treaty (RBStV) in conjunction with Section 8. 37 c) The scope of the restrictions imposed, which must be specified in accordance with Article 23 Paragraph 2 Letter c) of the GDPR, is derived in this case from Section 11 Paragraph 8 of the RBStV itself. Even though, unlike other restrictive provisions within the meaning of Article 23 of the GDPR, such as Section 32c of the German Fiscal Code (Abgabenordnung) or Section 11 of the German Federal Registration Act (Bundesmeldegesetz), Section 11 Paragraph 8 of the RBStV does not explicitly refer to the restricted provision of Article 15 of the GDPR in the sense that it is named verbatim as a provision, it follows from the term "right of access under data protection law" in Section 11 Paragraph 8 Sentence 2 of the RBStV that Article 15 of the GDPR is restricted by Section 11 Paragraph 8 of the RBStV. 38 (d) Guarantees against misuse or unlawful access or transmission exist firstly, through the mandatory appointment of an additional official data protection officer provided for in Section 11 Paragraph 2 of the Interstate Broadcasting Treaty (RBStV), provided that the responsible regional broadcasting corporation, as in the present case, entrusts a body pursuant to Section 10 Paragraph 7 of the RBStV, namely the Contribution Service, with activities related to the collection of contributions or the identification of contribution debtors. Secondly, Section 11 Paragraph 9 of the RBStV obliges the regional broadcasting corporations to ensure, through suitable technical and organizational measures, that data processing is carried out exclusively for the fulfillment of the tasks incumbent upon them under the Interstate Treaty. This stipulates that the strict purpose limitation pursuant to Section 11 Paragraph 7 Sentence 1 of the RBStV must also be ensured technically. 39 e) The provisions of Section 11, paragraphs 2 and 9 of the Interstate Broadcasting Treaty (RBStV) also address the risks to the rights and freedoms of data subjects. 40 f) The controller within the meaning of Article 4, No. 7 of the GDPR is determined by Section 11, paragraph 8, sentence 1 of the RBStV, namely, the regional broadcasting corporation responsible for the data subject requesting information. The data subject can contact this corporation to protect their rights. 41 g) Information on retention periods is contained in Section 11, paragraph 5, sentence 2 and paragraph 7, sentence 2 of the RBStV. 42 h) The inclusion of a right to be informed of the restrictions could be omitted in Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV) because, given the design of the broadcasting fee procedure as a mass procedure with more than 44 million fee accounts, informing the affected persons about the restrictions on their rights would be detrimental to the purpose of the restriction imposed in Section 11 Paragraph 8 of the RBStV (see also the explanatory memorandum of the Schleswig-Holstein State Parliament to the 21st Interstate Broadcasting Treaty Amendment, LT-Drs. SH 19/406 p. 51). 43 2.3. Since, consequently, Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV) lawfully restricts the right of access under Article 15 GDPR on the basis of Article 23 Paragraph 1 Letter e), Paragraph 2 GDPR, and Section 11 Paragraph 8 RBStV does not impose an obligation on the controller within the meaning of the General Data Protection Regulation to provide a copy of the personal data, the plaintiff has no right to demand that the defendant provide him with a copy of all personal data concerning him that is being processed by the defendant. 44 The defendant has sufficiently complied with the plaintiff's request for access by providing the information on November 29, 2024, December 4, 2024, and February 20, 2025, on the basis of Section 11 Paragraph 8 RBStV. The defendant has sufficiently complied with the plaintiff's request for access by providing the information on November 29, 2024, December 4, 2024, and February 20, 2025. 45 3. Insofar as the plaintiff, in his letter of October 22, 2025, requested a stay of proceedings pursuant to Section 94 of the Code of Administrative Court Procedure (VwGO) until a final and binding decision is rendered by the Bavarian Higher Administrative Court in the proceedings remanded by the Federal Administrative Court in its judgment of October 15, 2025 (Case No. BVerwG 6 C 12.24), the court did not grant this request, as the requirements for a stay under Section 94 VwGO are not met. 46 According to this provision, if the decision in the legal dispute depends wholly or partly on the existence or non-existence of a legal relationship that is the subject of another pending legal dispute or that is to be determined by an administrative authority, the court may order that the hearing be stayed until the other legal dispute is resolved or until the administrative authority renders its decision.47 This so-called preliminary aspect is lacking in the present case insofar as there is no judgment of the Federal Administrative Court of 15 October 2025 with the file number 6 C 12.24 cited by the plaintiff. There is no judgment of the Federal Administrative Court of 15 October 2025 with the file number 6 C 12.24. Insofar as the plaintiff referred to the judgment of the Federal Administrative Court of October 15, 2025, under file number 6 C 5.24, in which the case was remanded to the Bavarian Higher Administrative Court because, based on its legal opinion, the latter did not address the question of whether there was cause to initiate an evidentiary hearing to clarify whether the overall programming offered by the public broadcasting corporations exhibited evident and regular deficiencies with regard to the diversity and balance of content and opinions during the relevant period, this judgment, contrary to the plaintiff's assertion, contains no statements whatsoever regarding the requirement that Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV) requires a constitutionally and EU-law-compliant interpretation. The outcome of the remanded case before the Bavarian Higher Administrative Court is therefore completely irrelevant to the present proceedings. 48 Insofar as the applicant further requested in his letter of 22 October 2025, as a subsidiary claim, that the proceedings be referred to the Court of Justice of the European Union pursuant to Article 267 of the Treaty on the Functioning of the European Union (TFEU) for a preliminary ruling on the question of whether Article 23(1)(e) and (2) GDPR conflicts with the national provision of Section 11(8) RBStV in its current version, insofar as it restricts the right of access in a blanket manner and without sufficient legal guarantees, the Court has also rejected this request. 49 Pursuant to Article 267(1) TFEU, the Court of Justice of the European Union gives preliminary rulings on (a) the interpretation of the Treaties and (b) the validity and interpretation of the acts of the institutions, bodies, offices or agencies of the Union. A right to refer a question to the Court of Justice of the European Union exists under Article 267(2) TFEU if the Court is presented with a question under Article 267(1) TFEU and considers a ruling on that question necessary for rendering its judgment, i.e., if the Court has doubts about the interpretation of a provision of EU law and considers the clarification of these doubts necessary for rendering a decision in the main proceedings (Streinz/Ehricke, 3rd ed. 2018, TFEU Art. 267, beckonline). 50 The Court does not have such doubts. As explained above, Article 23 GDPR expressly permits restrictions on Article 15 GDPR. Restrictions are limitations, that is, curtailments of rights, which would not be possible without Article 23 GDPR. The comprehensiveness of this standard suggests that the restriction can be quite extensive, provided that the limitations under Article 23(2) GDPR are met, as in the present case (BeckOK DatenschutzR/Stender-Vorwachs/Wolff/von Ungern- Sternberg, 55th ed. 1.2.2026, GDPR Art. 23 para. 14, beckonline). 51 Insofar as the applicant, according to the grounds of his application, considers a preliminary ruling from the CJEU necessary to clarify the validity under EU law of the national restriction pursuant to Article 23 GDPR, this essentially concerns the question of the compatibility of the national provision of Section 11(8) RBStV with Article 23 GDPR, which is not admissible as a preliminary question (see Streinz/Ehricke, 3rd ed. 2018, TFEU Article 267 para. 14, beckonline). 52 Moreover, the court of first instance is under no obligation to refer the matter to the CJEU, since the present judgment can still be challenged by means of domestic legal remedies, in this case by lodging an appeal to the Bavarian Administrative Court of Appeal, which was granted by the court (Article 267(3) TFEU). 53 3. The decision on costs is based on Section 154 Paragraph 1 of the Administrative Court Procedure Act (VwGO), according to which the losing party must bear the costs of the proceedings. 54 4. The ruling on the provisional enforceability of the cost decision is based on Section 167 of the Administrative Court Procedure Act (VwGO) in conjunction with Sections 708 No. 11 and 711 of the Code of Civil Procedure (ZPO). 55 5. The appeal was admissible pursuant to Section 124a Paragraph 1 Sentence 1 in conjunction with Section 124 Paragraph 2 No. 3 of the Code of Administrative Court Procedure (VwGO) due to the fundamental importance of the legal issue, since the cross-case, generalizable question of whether Section 11 Paragraph 8 of the Interstate Broadcasting Treaty (RBStV) constitutes a lawful restriction of the right to information under Article 15 GDPR on the basis of Article 23 Paragraph 1 Letter e) GDPR, which was decisive in the present case and is also decisive for the appellate court and thus capable of clarification, has not yet been clarified and requires clarification in the appeal proceedings in the interest of legal certainty, legal uniformity, or the further development of the law.