VG Osnabrück - 7 A 170/24

Decision: It is hereby determined that the defendant failed to respond within the prescribed time limit to the plaintiff’s request for information submitted by letter dated August 21, 2024. The defendant shall bear the costs of the proceedings. The court order is provisionally enforceable with respect to the costs.The defendant may avert enforcement by posting security in the amount of 110% of the sum enforceable pursuant to the court order, unless the plaintiff first posts security in the amount of 110% of the respective sum to be enforced.Facts of the Case: The parties are in dispute over whether the defendant responded within the prescribed time limit to the plaintiff’s request for information under data protection law. The plaintiff is the holder of a hunting license and a firearms ownership card issued by the defendant. In 2023/2024, jurisdiction over the permits granted to him under the Firearms Act (WaffG) was transferred from K. to the defendant.

In this context, the defendant sent him a letter dated December 20, 2023 (BA001, p. 1 et seq.), titled “Information on the Processing of Personal Data Pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR) – Change in Jurisdiction Under Firearms Law.” In it, the defendant informed the plaintiff of the change in jurisdiction and stated that, as a result of this change, the plaintiff’s personal data—including his name, date of birth, contact information, and data collected in connection with his firearms permit—would now be processed, in particular collected and stored, by the defendant, FD L. The defendant had obtained this data from the firearms authority previously responsible for the plaintiff. The processing was carried out on a legal basis. The legal basis was the Firearms Act (WaffG) in conjunction with the Regulation Amending Jurisdictions in the Field of Firearms Law.

It served exclusively the purpose of public safety and order. Data is disclosed only on the basis of a legal obligation in accordance with the provisions of firearms law. No data is disclosed to third parties. The data is deleted in accordance with statutory provisions. Further information on data processing and data security is available on the defendant’s website, as specified. The defendant, FD L., as the controller, can be contacted at a specified email address or a specified mailing address. In addition, the plaintiff may contact the defendant’s data protection officer using the contact information also specified. The plaintiff may exercise the right of access, the right to rectification or erasure, the right to restriction of processing, and the right to object to processing with the defendant. Furthermore, he could contact the M. Data Protection Supervisory Authority, the State Data Protection Commissioner N. in O., and exercise his right to file a complaint there.

In a letter dated February 5, 2024 (BA001, p. 3), the plaintiff contacted the defendant, objected to the use of his private address for mailing letters, and requested that a specifically designated post office box address be used for this purpose in the future. In a letter dated February 16, 2024 (BA001, p. 4 et seq.), the defendant explained the rationale behind the use of the private address and stated that it was not possible to use the post office box address for sending automated correspondence because it could not be stored in the computer system. In a response dated March 5, 2024 (BA001, p. 6 ff.), the plaintiff stated that it was incomprehensible that an alternative mailing address could not be stored. The use of his home address for sending newsletters was not necessary. He requested the restriction of data processing pursuant to para 18(1)(d) of the GDPR and asked for confirmation of compliance with para 12 of the GDPR.

Furthermore, with regard to Art. 5(1)(f) and Art. 32(1)(a) of the GDPR, he requested information regarding the protection level the defendant had established for him, the plaintiff, and the implications thereof. Since the defendant did not respond, the plaintiff reminded the defendant of his request for restriction in a letter dated April 6, 2024 (BA001, p. 11) and, at the same time, requested—specifying a mailing address to be used—access to information pursuant to Article 15(1) of the GDPR, limited to the defendant’s Public Order Department. Furthermore, he requested copies pursuant to Article 15(3) of the GDPR in a single copy. The reason for this was his desire to gain an understanding of the data processing activities to date. The letter was received by the defendant on April 9, 2024. In a letter dated June 9, 2024 (BA001, p. 13 et seq.), received by the defendant the following day, the plaintiff provided his new post office box address.

At the same time, he reiterated his request for information under Article 15 of the GDPR, objected to the failure to meet the deadline set forth in Article 12(3) of the GDPR, and requested that the unlawfulness of the delayed provision of information be determined within 14 days. On July 12, 2024, the plaintiff filed a lawsuit, (most recently solely) seeking a declaration that the defendant had failed to provide the information within the time limit set forth in Article 12(3) of the GDPR—one month after receipt of the request dated April 6, 2024. The Chamber made a decision on this matter in a court order dated 00/00/2026 (Case No. Q.). By letter dated August 6, 2024 (BA001, p. 15 et seq.), received by the plaintiff on August 13, 2024, the defendant provided the plaintiff with further information as well as several screenshots apparently taken from its data processing programs. In a letter dated August 13, 2024 (BA001, p. 22), the plaintiff complained to the defendant that the information provided was incomplete, gave the defendant until August 23, 2024, to provide the missing information, and announced that he would otherwise file a lawsuit.

In particular, he stated that the request had concerned all data processed by or at the defendant. In a letter dated August 20, 2024 (BA001, p. 24 et seq.), received by the plaintiff on August 23, 2024, the defendant stated that it had forwarded the plaintiff’s request for information regarding all data stored by the defendant to the data protection officer. Since this would require the plaintiff’s personal data to be forwarded to all departments, the defendant requested that, if this were truly in the plaintiff’s interest, he contact the defendant’s data protection officer. In a letter dated August 21, 2024 (BA001, p. 27 ff.), which was received by the defendant the following day, the plaintiff requested “new information” from the defendant pursuant to Article 15(1) of the GDPR, limited to the Public Order Department, as well as copies pursuant to Article 15(3) of the GDPR in a single copy.

The requests covered “in particular (but not exclusively) the following documents: Firearms ownership card(s), hunting license, firearms license, firearms passport.” In a letter dated August 26, 2024, (BA 001, p. 31 et seq.), the plaintiff informed the defendant that, as evidenced by its wording, the request for information dated April 6, 2024, was limited to the defendant’s Public Order Department. No expansion or amendment of the request had taken place, nor was any intended. Insofar as he had referred in the letter dated August 13, 2024, to all data processed by or at the defendant, this could indeed be interpreted as misleading. However, this should be viewed in the context of the request and thus referred to all data processed by or at the defendant’s Public Order Department. On August 27, 2024, the plaintiff filed another lawsuit, seeking in particular to compel the defendant to supplement the information provided in response to the request of April 6, 2024, pursuant to Article 15 of the GDPR.

In the course of the proceedings, the defendant further supplemented its response, including in a letter dated September 24, 2024. That letter states, among other things, that at least four departments within the Public Order Division would be affected, to which the plaintiff’s last name, first name, date of birth, and place of residence would need to be forwarded in order to uniquely identify his data there. The defendant therefore requested the plaintiff’s consent to this or a statement limiting the access request to the subject area of “Hunting/Firearms.” The Chamber made a decision on the lawsuit by court order dated 00/00/2026 (Case No. R.). On October 15, 2024, the plaintiff filed the lawsuit to be subject to a decision in the present case. He asserts that the information requested in a letter dated August 21, 2024, has not yet been provided to him. Insofar as the defendant stated that, in order to process the request, his home address or place of residence must be disclosed to at least four departments of the Public Order Division, this is not comprehensible.

His data could also be identified by his last name, first name, and date of birth. Regardless, the information from the “Hunting/Firearms” division should in any case have been provided by September 22, 2024.The plaintiff requests (verbatim) that the court find that the defendant failed to provide the information regarding the request dated August 21, 2024, within the prescribed time limit pursuant to Article 12(3) of the GDPR. The defendant argues that the lawsuit lacks standing. In a letter dated August 21, 2024, the plaintiff requested the same information as in his letter dated April 6, 2024, even though he incorrectly referred to it as “new information.” This right to information is already the subject of the Court proceedings under case numbers Q. and R. Furthermore, the plaintiff’s conduct also constitutes an abuse of rights. In the letter dated September 24, 2024, the defendant had also sought to provide the plaintiff with further information to enable him to clarify his request for information.

The defendant assumes—also in light of the plaintiff’s stated lack of understanding regarding the involvement of four departments —assumes that the access request does not refer to all of the plaintiff’s personal data processed by the Public Order Department, but only to the “Hunting/Weapons” division.The plaintiff disputes this, arguing that the requests dated April 6, 2024, and August 21, 2024, are two distinct requests. Furthermore, the request at issue here is not excessive within the meaning of Article 12(5), second sentence, of the GDPR. While the law does not define when requests for access are deemed to be made too frequently, However, based on the interpretation of Article 12(3), para 1 and para 2, and Article 78(2) of the GDPR, one request per quarter should not be considered excessive. However, this is not relevant for determining whether there was a delay in providing the information.

Finally, it is not the responsibility of the controller to provide the data subject with further information for the purpose of clarifying the request for information. The request must be fulfilled as the data subject wishes. On December 20, 2024, the plaintiff filed another lawsuit seeking to compel the defendant to issue a decision on the request for information dated August 21, 2024, which the defendant had withdrawn following a judicial directive that the request for information was likely excessive (Case No. T.). The Chamber has consulted the files of Case Q. With regard to the further submissions of the parties, reference is made to their briefs; with regard to the remaining facts of the case, reference is made to the court files and the administrative records consulted.Reasons for the Decision: After hearing the parties in accordance with § 84(1) VwGO, the Court issues this order because the matter does not present any particular difficulties of a factual or legal nature and the facts of the case have been clarified.

The Chamber interprets the lawsuit as meaning that the plaintiff seeks a declaration that his request for information dated August 21, 2024, was not decided within the prescribed time limit (see § 88 VwGO). The lawsuit, interpreted in this way, is successful. A. The lawsuit is admissible. I. It is admissible as a lawsuit for a declaratory judgment within the meaning of § 43(1) VwGO. According to this provision, a declaration regarding the existence or non-existence of a legal relationship or the nullity of an administrative act may be sought if the plaintiff has a legitimate interest in a prompt determination. The relationship between the defendant (as the controller within the meaning of the GDPR) and the plaintiff constitutes a legal relationship within the meaning of the provision. A legal relationship is understood to be the legal connection between persons or between persons and objects that arises from a set of facts based on a legal provision.

Although the GDPR does not provide that a person may request a determination of a legal violation, the rights under the GDPR are limited to access (Art. 15), rectification (Art. 16), and erasure (Art. 17), restriction of processing (Art. 18, 21), and data portability (Art. 20). However, it is a matter for the domestic legal system of each Member State to determine the procedural modalities of the legal remedies intended to protect citizens’ rights, provided that, in situations governed by Union law, those procedures are no less favorable than those governing similar situations subject to national law (principle of equivalence), and that they do not render the exercise of the rights conferred by Union law practically impossible or excessively difficult (principle of effectiveness).Under these conditions, a finding that a controller has infringed upon subjective rights under the GDPR may also give rise to a legal relationship within the meaning of § 43(1) VwGO.

The general action for a declaratory judgment provided for in the national rules of procedure applies to all matters falling within its substantive scope of application. Its application to cases of alleged violations under the GDPR also takes into account the principle of effectiveness. This is because it makes it possible to ensure the objective pursued by the GDPR of a high level of protection for the fundamental rights and freedoms of natural persons in the processing of personal data (see, regarding the foregoing, BSG, judgement of Sept. 24, 2024 - B 7 AS 15/23 R —, juris paras. 39–41, with further references). II. The plaintiff also has a legitimate interest in a prompt declaratory judgment (interest in a declaratory judgment). This constitutes a specific manifestation of the general need for legal protection (see BVerwG, judgement of November 6, 1991—8 C 10.90—, juris para. 13). 1.

According to general opinion, such an interest is any interest worthy of protection that is of a legal or factual nature, particularly of an economic or non-material nature. The decisive factor is that the sought-after declaration is capable of improving the plaintiff’s legal position (see BVerwG, Judgement of Oct. 25, 2017 – 6 C 46.16 –, juris para. 20). If—as in this case—a legal relationship that occurred in the past is in dispute, the decisive factor is whether the legal relationship still gives rise to ongoing (adverse) effects. In this regard, the standards developed for actions for a declaration of continuation under § 113(1), fourth para, VwGO must be applied (see BVerwG, judgement of April 29, 1997—1 C 2.95—, juris para. 16 et seq.; Osnabrück Administrative Court, judgement of Nov. 7, 2023—7 A 9/23—, p. 6 of the judgement, as amended; Sodan, in: NK-VwGO, 6th ed. 2025, VwGO § 43, para. 90, beck-online; Marsch, in: Schoch/Schneider, 48th ed., July 2025, VwGO § 43, para. 35, beck-online).

Accordingly, the required (substantial) interest in a declaratory judgment may exist, in particular, where there is a risk of recurrence, ongoing discrimination (interest in rehabilitation), in cases where there is an intention to assert claims for official liability or compensation (interest in establishing a precedent), as well as in cases of profound infringements of fundamental rights where the measures in question are typically resolved in the short term (see BVerwG, judgement of April 24, 2024—6 C 2.22—, juris para. 16 et seq.). In all these cases, however, the interest in a declaratory judgment must go beyond a mere interest in clarifying the unlawfulness of the decision in question (see Nds. OVG, judgement of March 30, 2023—14 LC 32/22—, juris para. 40). 2. In the case at hand, there is a risk of repetition.This requires a concrete risk that the contested administrative act will be repeated in the future (see Lower Saxony Higher Administrative Court, Order of July 22, 2020 – 11 LA 104/19 –, juris para. 10).

Furthermore, the legal and factual circumstances relevant to the assessment must have remained essentially unchanged (see Federal Administrative Court [BVerwG], Judgement of April 24, 2024 – 6 C 2.22 –, juris para. 17, with further references; Federal Administrative Court (BVerwG), Order of April 26, 1993 – 4 B 31.93 –, juris para. 26 et seq. with further references; Sodan, in: NK-VwGO, 6th ed. 2025, VwGO § 43, para. 91, beck-online). By contrast, the mere vague possibility of a recurrence is not sufficient; rather, concrete indications of a recurrence must be asserted and must exist (see Bav. VGH, Order of March 13, 2017 – 10 ZB 16.965 –, juris para. 11; Riese, in: Schoch/Schneider, 48th ed., July 2025, VwGO § 113, para. 126, beck-online). These requirements are met in this case: The plaintiff has already stated in the Q. lawsuit that he intends to submit recurring access requests under Art. 15 of the GDPR to the defendant in the future.

Against this background, in light of the plaintiff’s established practice with other authorities, and given that the defendant remains responsible for the plaintiff—at least with regard to firearms law—everything indicates that the plaintiff will continue to submit such access requests in the future. The defendant, for its part, continues to maintain—as evidenced by its submissions in the proceedings—that it acted in a lawful manner. III. The lawsuit is also not inadmissible on the grounds of double lis pendens or—as the defendant contends—due to a lack of need for legal protection, because the subject matter of the dispute is already pending in proceedings Q. and R. In his letter dated August 21, 2024, the plaintiff expressly submitted a new request for information pursuant to Article 15 of the GDPR. Whether and, if so, how this request is to be decided is a matter of the merits of the lawsuit.

B. The lawsuit is also well-founded. Pursuant to Article 12(3) of the GDPR, the controller (here: the defendant) must provide the data subject (here: the plaintiff) information regarding the measures taken in response to requests under articles 15 through 22 without undue delay, and in any event within one month of receiving the request. This period may be extended by an additional two months if necessary, taking into account the complexity and the number of requests. The controller shall inform the data subject of any extension of the deadline within one month of receiving the request, along with the reasons for the delay. If the data subject submits the request electronically, the controller shall, where possible, provide the information electronically, unless the data subject specifies otherwise. If, on the other hand, the controller makes the decision not to act on the data subject’s request, it shall inform the data subject without delay, in accordance with Article 12(4) of the GDPR, and no later than one month after receipt of the request, of the reasons for this and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.

The time limit begins to run upon receipt of the request by the controller. Where applicable, and notwithstanding the foregoing, the time limit shall be based on the verification of identity pursuant to Article 12(6) of the GDPR; however, this does not require any further decision in the present case. If the data subject is represented by an attorney and the controller requires a power of attorney, the time limit begins upon submission of the original power of attorney (see Franck, in: Gola/Heckmann, 3rd ed. 2022, GDPR Art. 12, para. 27, beck-online; Heckmann/Paschke, in: Ehmann/Selmayr, 3rd ed. 2024, GDPR Art. 12, para. 32, beck-online). This was also not the case here. The event triggering the time limit was thus the defendant’s receipt of the request on August 22, 2024. The time limit is calculated in accordance with Council Regulation (EEC, Euratom) No. 1182/71 of June 3, 1971, laying down rules relating to periods, dates, and time limits (“Time Limits Regulation,” see Franck, in: Gola/Heckmann, 3rd ed. 2022, GDPR Art. 12, para. 27, beck-online).

Pursuant to Art. 3(2)(c) of this Regulation, the one-month period under Art. 12( 3, sentence 1, of the GDPR—because September 22, 2024, fell on a Sunday—on September 23, 2024. In the present case, the defendant failed to meet this deadline. In particular, the defendant also did not grant an extension of the deadline pursuant to Article 12(3), second and third sentences, of the GDPR, regardless of whether the requirements for such an extension were met in this case. Nor does any lack of specificity regarding the scope of the request for information preclude the conclusion that the deadline was missed. Based on the objective recipient’s perspective (by analogy with Sections 133, 157 of the German Civil Code (BGB)), the request must be interpreted as concerning the defendant’s entire Public Order Department. Finally, the assumption that the deadline was missed is not precluded by the fact that there is strong evidence suggesting that the request for information contained in the letter dated August 21, 2024—in light of the request contained in the letter dated April 6, 2024— —be considered excessive within the meaning of Article 12(5), second sentence, of the GDPR.

For even if one were to assume this in the present case, this would have (merely) entitled the defendant either to charge a reasonable fee that takes into account the administrative costs of providing the information, issuing the notice, or carrying out the requested action, or to refuse to act on the request. Even in the latter case, however, the defendant would have been obligated to issue a denial of the request that complied with Art. 12(4) of the GDPR (see also Bäcker, in: Kühling/Buchner, 4th ed. 2024, GDPR Art. 12, para. 32, beck-online; Heckmann/Paschke, in: Ehmann/Selmayr, 3rd ed. 2024, GDPR Art. 12, para. 45, beck-online). It is true that an objection has been raised to this, namely that a blanket obligation to justify the excessive nature of a request could lead to unfair results, because the requester could then achieve his goal of causing the controller unnecessary effort, (see Ligocki/Sosna/Meyer, “Limits of the Right to Information,” ZD 2025, p. 137 [143]).