OLG Wien - 13R70/25x

877.39 (including EUR 146.23 VAT), within 14 days. An appeal on points of law is not permitted. Text Reasons for the Decision Based on Article 15(3) GDPR, the plaintiff ultimately seeks a judgment ordering the defendant to provide him with a digital copy of his data, which is being processed by the defendant, in particular invoice copies and transaction data. Insofar as relevant to the appeal proceedings, he argued that the defendant had not fully complied with his request for access. The defendant refused to provide him with a complete copy of his data free of charge. The defendant requests that the action be dismissed. Insofar as relevant to the appeal proceedings, the defendant essentially argued that it had complied with both of the plaintiff's requests for information in a timely and complete manner. The plaintiff, for reasons explained in detail, had no legal right to the requested invoice copies, but only to the personal data itself. Booking data, it argued, was merely financial data that could not be individually attributed to the plaintiff. The defendant had provided the plaintiff with the payment data on file, so that it was clearly possible for him to trace which bank account had been debited. In the judgment under appeal, the court of first instance dismissed the action. It based its decision on the facts set forth on pages 1 to 3 and 5 of the judgment of the court of first instance, to which reference is made. Regarding the sole issue addressed in the appeal—the defendant's obligation to provide (further) invoice copies—the court summarized the legal arguments, supported by legal citations, by stating that in Case C*, the CJEU had ruled that the right to receive a copy of entire documents exists when it is essential to enable the data subject to effectively exercise the rights conferred upon them by this Regulation. This is particularly the case when contextualizing the processed data is necessary to ensure its comprehensibility, for example, when personal data is generated from other data. However, the burden of proof as to why receiving a copy is essential for exercising the data subject's rights lies with the data subject themselves. The argument that a copy is essential for the completeness of the information provided is insufficient. However, the burden of proof for demonstrating that providing a copy is essential for the data subject to exercise their rights lies with the data subject. The mere fact that the data subject already possesses the data does not, in itself, grant the controller a right to refuse access. However, it may limit the scope of the request, particularly regarding the provision of data (including copies), as the necessity for understanding the data processing within the meaning of the CJEU's case law could be questioned. In the present case, the transmission of invoice copies is not necessary for understanding the data processing. Furthermore, there is no indication that providing a copy of the data would be essential to enable the plaintiff to effectively exercise the rights granted to him by the GDPR (e.g., rectification, erasure, etc.). The burden of proof for this lies with the plaintiff. The plaintiff, who bears the burden of proof regarding this matter, received all invoices for his (active) contract after the respective billing periods. The defendant is therefore free to make the re-issuance of invoices contingent upon payment of a fee, in accordance with the agreed-upon payment terms. The information provided by the defendant was thus sufficient, and the plaintiff's claim should have been dismissed. The plaintiff appeals this judgment on the grounds of incorrect legal assessment and procedural defects, requesting that the judgment be granted and, alternatively, that it be set aside. The defendant requests that the appeal be dismissed. Legal Assessment The appeal is unfounded.

Referring to the judgment of the Court of Justice of the European Union of 26 October 2023, FT (Copies du dossier médical) (C-307/22), which established that the data subject is not required to provide a reason for requesting a copy of their personal data from the controller, and that a right to receive a copy of personal data exists even if it is intended for purposes unrelated to the GDPR, the applicant finds it incomprehensible why they should have had to demonstrate and prove that this was the only way to enable the "effective exercise of the rights conferred upon them by this Regulation." The court of first instance thus imposed a burden of proof on them that is not provided for in the GDPR and thereby unjustly and severely restricts the applicant's rights under Article 15(3) GDPR. Therefore, the lower court's legal assessment was incorrect, and the plaintiff's claim should have been granted. The lower court thus imposed a burden of proof on him that is not provided for in the GDPR and thereby unjustly and severely restricted the plaintiff's rights under Article 15(3) GDPR. Therefore, the lower court's legal assessment was incorrect, and the plaintiff's claim should have been granted.

According to Article 15(1) GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data. Article 15(3) GDPR specifies the data subject's right of access insofar as the controller must provide him or her with a copy of the personal data undergoing processing. According to Article 15(1) of the GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data. Article 15(3) of the GDPR further specifies the data subject's right of access, in that the controller must provide the data subject with a copy of the data undergoing processing. According to Recital 63, first sentence, of the GDPR, a data subject should have the right to access the personal data concerning him or her that have been collected and should be able to exercise this right easily and at reasonable intervals in order to be aware of the processing and to verify its lawfulness. The purpose of the access request is to enable the data subject to verify the lawfulness and accuracy of the data processing. The right of access is not subject to any conditions. In particular, it does not need to be justified by a legal interest or an interest in obtaining information (Haidinger in Knyrim, DatKomm Art. 15 GDPR para. 25). According to Recital 63, sentence 1 of the GDPR, a data subject should have the right to access their personal data that has been collected and be able to exercise this right easily and at reasonable intervals in order to be aware of the processing and to verify its lawfulness. The purpose of the access request is to enable the data subject to verify the lawfulness and accuracy of the data processing. The right of access is not subject to any conditions. In particular, it does not need to be justified by a legal interest or an interest in obtaining information (Haidinger in Knyrim, DatKomm Art. 15 GDPR para. 25). Recital 63, sentence 1 of the GDPR, a data subject should have the right to access their personal data and be able to exercise this right easily and at reasonable intervals in order to be aware of the processing and to verify its lawfulness. In its judgment of 26 October 2023, C-307/22 (FT (Copies du dossier médical)), the Court of Justice of the European Union clarified that the obligation to provide information exists even if the request for information is based on purposes other than those listed in the first sentence of recital 63 of the GDPR. The fact that the data subject is not obliged under the GDPR to justify their request for information means that such a request cannot be contingent on invoking one of the grounds listed in the first sentence of recital 63 of the GDPR. A request for information is therefore not "manifestly unfounded" or an abuse of rights if it pursues objectives unrelated to data protection. This means that an obligation to provide information also exists if the person entitled to information pursues (at least also) purposes other than to take note of the processing of their data and to check its legality with a request for information (Haidinger, aaO para. 48/3). Although the purpose of the request for information or the data subject's motive for making it is initially irrelevant, "non-data protection" motives do become relevant when it comes to the scope of the claim regarding the disclosure of data (including copies) (Haidinger, loc. cit., para. 25, 47/4, 48/2). Regarding the specific implementation of the "right to a copy" enshrined in Article 15(3) GDPR, the CJEU ruled in case C-487/21 (Case C*) that Article 15(3) means that the data subject must be provided with a true and intelligible reproduction of all such data, but only if providing such a copy is essential to enable the data subject to effectively exercise the rights conferred upon them by this Regulation. Although the purpose of the access request or the data subject's motive for making it is initially irrelevant, "non-data protection" motives do become relevant when it comes to the scope of the right to access data (including copies) (Haidinger, loc. cit., paras. 25, 47/4, 48/2). Regarding the specific interpretation of the "right to a copy" enshrined in Article 15(3) of the GDPR, the CJEU ruled in case C-487/21 (Case C*) that Article 15(3) means that the data subject must be provided with a true and intelligible reproduction of all such data, but only if providing such a copy is essential to enable the data subject to effectively exercise the rights conferred upon them by this Regulation. A right to a copy therefore exists whenever the true reproduction of documents, database entries, images, sound recordings, etc., is necessary for a simple understanding of the data processing. The burden of proof that providing a copy is essential for exercising the data subject's rights lies with the data subject themselves. Simply asserting that a copy is essential for the completeness of the information is not sufficient (Haidinger, loc. cit., paras. 35 et seq.). A right to a copy thus exists whenever the true reproduction of documents, database entries, images, sound recordings, etc., is necessary for a clear understanding of the data processing. Mutatis mutandis, this principle also applies to cases in which the data subject pursues objectives unrelated to data protection and seeks to obtain information beyond what is necessary for understanding the data processing. Even in such a situation, providing a copy in the sense of a faithful reproduction must be essential to enable the data subject to effectively exercise their rights, and the burden of proof rests with the data subject. Thus, the lower court's legal assessment proves to be correct.

A violation of Sections 182 and 182a of the German Code of Civil Procedure (ZPO) is alleged to lie in the fact that the lower court failed to discuss with the parties the plaintiff's burden of proof regarding the indispensability of providing a copy of their personal data for the effective exercise of their rights under the GDPR. A violation of Sections 182 and 182a of the German Code of Civil Procedure (ZPO) is alleged to lie in the fact that the court of first instance failed to discuss with the parties the plaintiff's burden of proof regarding the indispensability of providing a copy of his personal data for the effective exercise of his rights under the GDPR. Had the court of first instance pointed this out, the plaintiff could have argued and proven that providing a copy of his personal data (in particular, outstanding invoice copies) was necessary and essential to verify the legality of the "service fee" charged and paid by the defendant.

The court may not surprise a party with a legal opinion that it has not considered (see RS0037300); this also applies in cases where the claim is insufficiently substantiated. This principle is derived from Sections 182 and 182a of the German Code of Civil Procedure (ZPO) (RS0108816). According to these provisions, however, the court is not obligated to consider an argument whose weaknesses or need for supplementation have already been pointed out by the opposing party. In light of such objections from the opposing party, the affected party must review its own position and draw the necessary conclusions (RS0122365). 2.2 The court may not surprise a party with a legal opinion that it has not considered (compare RS0037300); this also applies in the case of an insufficiently substantiated claim. This principle is derived from Sections 182 and 182a of the Code of Civil Procedure (RS0108816). According to these provisions, however, the court is not obligated to consider an argument whose weaknesses or need for supplementation have already been pointed out by the opposing party. In light of such objections from the opposing party, the affected party must review its own position and draw the necessary conclusions (RS0122365). The court may not surprise a party with a legal opinion that it has not considered (compare RS0037300); this also applies in the case of an insufficiently substantiated claim. The defendant argued that paragraph 32 of the ECJ decision C-487/21 cited by the plaintiff explicitly states that, according to the understanding of both institutions, "the term 'copy' does not refer to a document as such, but to the personal data it contains." The plaintiff's legal arguments, namely that ECJ decision C-487/21 supports a right to copies of invoices, are therefore clearly misinterpreted. Accompanying documents or even entire documents are only necessary if, without them, the disclosure of the data would be unclear to the average data subject. However, this is not the case here (SS ON 8, 5). Based on this argument alone, the plaintiff, in accordance with the aforementioned case law, should have recognized, even without guidance from the court of first instance, the necessity of providing copies of invoices—that is, copies of corresponding documents, as generally understood—for the effective pursuit of his rights and his legitimate objective. The alleged procedural defect does not exist. The unjustified appeal was dismissed. The decision on costs is based on Sections 41 and 50 of the German Code of Civil Procedure (ZPO). The decision on costs is based on Sections 41 and 50 of the German Code of Civil Procedure (ZPO). A ruling on the assessment pursuant to Section 500(2)(1) of the Code of Civil Procedure (ZPO) is not required for the claim asserted under Article 15(3) GDPR (6 Ob 138/20t [27] with further references). A ruling on the assessment pursuant to Section 500(2)(1) of the Code of Civil Procedure (ZPO) is not required for the claim asserted under Article 15(3) GDPR (6 Ob 138/20t [27] with further references). The appeal decision did not depend on the resolution of a significant legal question within the meaning of Section 502(1) of the Code of Civil Procedure (ZPO) with significance beyond the individual case. Therefore, leave to appeal to the Federal Court of Justice (Revision) was not granted.