AG Arnsberg - 42 C 434/23

The interested party must consent to the processing of their data, and they are directed to the plaintiff's privacy policy via an anchor link. When subscribing to the newsletter, the interested party must proactively provide their data, whereby only the provision of an email address is required for successful registration. On March 13, 2023, the defendant subscribed to the plaintiff's newsletter, providing his email address @ “ and also his first and last name. On March 29, 2023, the defendant sent a request for information pursuant to Article 15 GDPR by fax, using letterhead containing his full residential address, email address, and fax number. On April 26, 2023, the plaintiff refused to provide the information, arguing that the request was an abuse of rights. The plaintiff cited media reports that the defendant subscribed to numerous newsletters solely for the purpose of pursuing claims for damages.

Furthermore, the plaintiff informed the defendant that he could lodge a legal remedy with the supervisory authority of the State of North Rhine-Westphalia and with the court responsible for Arnsberg. 00. The plaintiff maintains that the rejection of the defendant's request was permissible due to his abusive intent. The registration for the newsletter was solely for the purpose of later claiming damages. The numerous blog posts on the internet demonstrate that the defendant developed a three-step business model (newsletter registration, request for Article 15 GDPR, and claiming damages). In addition to this publicly available information from the internet, the specific procedure suggests that it was not a permissible enforcement of rights, because the defendant as a person living abroad, had registered for a newsletter with information about the plaintiff's branch operations in North Rhine-Westphalia and submitted his request for information just two weeks later.

00 for refusing the data protection information request submitted by the defendant on March 29, 2023, as requested in the letter of June 29, 2023. 00, the parties mutually agreed to settle the legal dispute with regard to the claim. With regard to the claim, the parties have submitted reciprocal motions for costs. Counterclaim The defendant requests that the plaintiff be ordered to: 1. provide the defendant with a copy of all personal data that the plaintiff processes concerning the defendant. 2. provide the defendant with information about the purposes for which the plaintiff processes the defendant's personal data. 3. provide the defendant with information about the recipients of his data to whom the plaintiff has transmitted the defendant's personal data. 4. provide the defendant with information as to whether the plaintiff has carried out automated decision-making or profiling concerning the defendant's personal data.

5. 00. The plaintiff requests that the counterclaim be dismissed. The defendant claims that he regularly resides in Germany, particularly in Munich and in Düsseldorf and therefore have an interest in the plaintiff's business. He has suffered non-material damage due to the loss of control over his data. He has been deprived of the right, as a natural person, to be able to verify that his data is being processed correctly and lawfully. The entries about him on the internet are unverified information and aggressive advertising measures by lawyers. He has suffered damage because his other rights to rectification, erasure, restriction of processing, data portability, and objection under Article 16 GDPR have been restricted. Furthermore, the non-material damage is based on emotional distress, as the defendant, being a data protection-sensitive person, values it that all institutions associated with him comply with data protection regulations.

The refused information has triggered worries and anxieties in him regarding the fate of his data. He feels considerable The defendant was annoyed because the refusal made transparency regarding data usage more difficult. The court referred the present proceedings to the European Court of Justice for a preliminary ruling by order of July 31, 2024. Reference is made to the judgment there (Judgment of March 19, 2026, Case C-526/24). Furthermore, reference is made to the case file and the parties' written submissions. Reasons for the decision: The action was originally admissible and well-founded; the counterclaim is unfounded. The plaintiff was justified in refusing the defendant's request for information. I. The defendant has no right to receive a copy of the personal data processed by the plaintiff or to be provided with the requested information about the use of his data provided, pursuant to Article 15(1) and (3) of the GDPR.

This is because the plaintiff was, according to the GDPR, Article 12(5)(b) GDPR justifies rejecting the request of the defendant as excessive. According to the judgment of the European Court of Justice of 20 March 2026 in the preliminary ruling procedure C-526/24, even an initial request to a person obliged to provide information can be excessive and rejected on the grounds of abuse of rights. The applicant has sufficiently demonstrated that this intent to abuse the system existed on the part of the defendant. Based on the judgment of the European Court of Justice of 20 March 2026, Case C-526/24, the prerequisites for proving abusive conduct are: firstly, the totality of the objective circumstances which, despite formal compliance with the conditions, fail to achieve the objective of the regulation, and secondly, from a subjective perspective, the intent to gain an advantage from the EU regulation by artificially creating the conditions for obtaining the information.

, when a claim for damages is artificially created. All circumstances of the individual case are decisive for this assessment. In particular, it can be taken into account whether a data subject provided their data voluntarily, or what purpose the provision of the data served, the time elapsed between the provision of the data and the access request, and the data subject's other conduct. In this context, the controller may also consider publicly available information from the internet, provided that this is corroborated by other relevant evidence. Therefore, taking all circumstances into account, the court is convinced that the defendant's conduct was abusive. This conclusion is based on the following points: First, the defendant voluntarily provided his data. To this end, he not only used a non-anonymized email address but also provided his full name, thus voluntarily providing even more data than would have been required for newsletter registration.

Furthermore, glasses purchased at a discount in North Rhine-Westphalia would not be significantly cheaper than glasses purchased at the regular price near their residence to offset the travel costs and justify the time investment. Purchasing glasses in Germany offers the defendant no discernible advantage. Therefore, there can be no interest in the plaintiff's company or its newsletter. The defendant failed to demonstrate a personal interest in the newsletter in question, even at the oral hearing. Despite being ordered to appear in person, the defendant was not present. The question of whether the power of attorney granted to his legal representative was valid pursuant to Section 141 Paragraph 3 Sentence 2 of the German Code of Civil Procedure (ZPO) can remain undecided. This is because the legal representative could only provide superficial information regarding his client's interest in the newsletter and was not sufficiently able to clarify the facts, as evidenced by his statement that he believed the defendant wore contact lenses.

Rather, it should be considered that in addition to the cases mentioned online, there is likely a much higher number of unreported cases in which the recipient of the cease-and-desist letter did not seek legal assistance or did not publicize the case online. This impression is further reinforced by the fact that the defendant's legal representative could have substantively countered this claim at the oral hearing and specified the number of cases. Simply claiming, when questioned, that no information could be provided and that it involved internal matters, is unconvincing. Furthermore, the defendant's behavior is highly inconsistent. If the defendant is indeed such a data-sensitive person, as he claims, one would expect a much more defensive and cautious approach from him. Instead, he voluntarily subscribes to an increasing number of newsletters, in this case from a company, for which no genuine interest can be discerned, repeatedly and voluntarily disclosing more than the required amount of data.

Based on the publicly accessible information about the defendant's behavior, the subscription in this case also occurred at a time when he had already subscribed to many newsletters. He must have been aware at that point of the risk to which he was exposing his data. One would have expected a very data-sensitive person to handle their data differently than the behavior evident here. In light of these numerous indications, the abusive intent cannot be dismissed simply by asserting that the defendant not only sued for damages but also sought the disclosure of his data in court. The defendant's argument that the plaintiff is precluded from raising the defense of abuse of rights due to a formally invalid refusal is also unconvincing. Even assuming any formal errors exist, they would only give rise to secondary claims, but would not negate the existence of the substantive defense under Article 12(5) GDPR.

II. The counterclaim is also unfounded with regard to the claim under point 5) for payment of monetary compensation under Article 82(1) GDPR. This is because no such claim exists due to the lack of a violation of the GDPR. The plaintiff was entitled to refuse the defendant's request for information because of the defendant's abusive intent (see above). Although the court has doubts as to whether the defendant has sufficiently substantiated the amount of the damage , a claim for compensation would in any case also fail because the causal link between the breach and the damage is broken, since the defendant's own conduct alone triggered the alleged loss of control and the alleged uncertainty (see CJEU, Judgment of 19 March 2026, Case C-526/24). 10 Furthermore, the court cannot identify any formal defect in the plaintiff's letter of refusal that would give rise to a claim for damages. The deadline of Article 12(4) GDPR was met.

The court can neither find, nor has the defendant substantiated, that the plaintiff culpably delayed its response. Ungern- Sternberg, 55th edition 2022, GDPR Art. 12 para. 40). The controller must be granted a certain amount of time to review the request (see Heckmann/Paschke, in: Ehmann/Selmayr, Datenschutz-Grundversordnung, 3rd edition 2024, GDPR Art. 12 para. 39). The court also finds no lack of reasoning. The reasons why the plaintiff rejected the request are understandable and explained in sufficient detail. The court cannot identify any formulaic rejection (see Ehmann/Selmayr, General Data Protection Regulation, 3rd ed. 2024, GDPR Art. 12 para. 37). Thus, after receiving the rejection letter, the defendant was able to examine whether or not he wished to lodge an appeal against the rejection (see Bäcker, in: Kühling/Buchner, GDPR BDSG, 4th ed. 2024, GDPR Art. 12 para. 32). Nor can the court identify any error in the instructions on legal remedies, in that the plaintiff only referred to the possibility of filing a complaint with the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia, but not also with an authority in the defendant's home country.

Thus, the wording of Article 12(4) GDPR requires that information about the possibility of a legal remedy be provided before one, not all, authorities. This is also reflected in the fact that the wording only requires information about a legal remedy before one authority or a court, not both cumulatively. What the law requires of a private individual here is alien to the system and is otherwise required of authorities or courts (see Heckmann/Paschke, in: Ehmann/Selmayr, General Data Protection Regulation, 3rd ed. 2024, GDPR Art. 12 para. 41). III. 11 Due to the lack of prerequisites, the alternative requests for suspension of the proceedings and referral of the case to the Court of Justice of the European Union for a preliminary ruling, and alternatively pending a decision in the proceedings mentioned in the requests, could not be granted. This is because, firstly, the court finds no evidence whatsoever that the defendant's actions were also motivated by the desire to inform the website operator about the data protection issues associated with the integration of Google Fonts.

The defendant has not relied on this argument either in or out of court. The motion is now being made purely as a procedural tactic. Otherwise, the defendant would have had to involve the data protection authority extensively if he were pursuing a proselytizing agenda. Since, following the referral to the European Court of Justice in these proceedings and the subsequent review by the court, it is established that there has been no breach of the duty to provide information, a further stay of proceedings pending other proceedings is not necessary. IV. The procedural ancillary decisions are based on Sections 91(1), 91a, and 709 of the German Code of Civil Procedure (ZPO). 00. Since, following the referral to the European Court of Justice in these proceedings and the review now being conducted by the court, it is established that there has been no breach of the duty to provide information, no further stay of proceedings is necessary.