GDPR Right of Information: Unreasonable effort is not an excuse!
Tax office refuses data request due to expense
Are you facing a data protection regulation (GDPR) disclosure obligation and are you afraid of disproportionate effort? A new judgment from the Federal Finance Court (BFH) puts an end to this. Find out here why authorities and companies can no longer rely on excessively high costs to refuse disclosure under Article 15 of the GDPR.
One plaintiff requested from the tax office the full disclosure of his stored personal data in accordance with Article 15 of the GDPR, including copies of all data. The tax office provided only an overview and offered access to the files, but refused to provide complete copies. The reason: disproportionate effort. This case eventually ended up before the BFH.
The BFH ruling: GDPR right of access applies without restriction
The BFH ruled in favor of the plaintiff. Authorities and companies may not rely on „unreasonable effort“ to circumvent the GDPR’s disclosure requirement. The General Data Protection Regulation does not provide for such a reason for refusal. Even if a request for information is extensive, it cannot be rejected as „excessive“ solely because of that fact.
The most important arguments of the BFH:
No analog application of Article 14(5)(b)(2) of the GDPR: The exception due to disproportionate expense applies only to the information obligation under Article 14 of the GDPR, not to the GDPR information obligation under Article 15 of the GDPR.
No general proportionality clause: The right to information is independent of the effort required by the responsible person.
What does the judgment mean for companies? Implement the GDPR information obligation!
This judgment has far-reaching consequences for the practice of the GDPR’s information disclosure obligation:
Unreasonable effort GDPR:
What is „unreasonable effort“ in the context of the GDPR?
The term is not clearly defined, but the BFH makes it clear that it cannot be used as a justification for refusing to provide information.
How can I efficiently implement the GDPR’s disclosure obligation?
Invest in appropriate software and processes to process data requests quickly and completely.
Where can I find more information about the GDPR disclosure obligation?
Consult the official website of the European Commission or a specialized data protection lawyer.
Conclusion: Take the GDPR information disclosure obligation seriously!
The BFH ruling strengthens the rights of those affected and makes it clear: the GDPR’s disclosure requirement must be taken seriously. Companies must adapt their processes and be prepared for requests, regardless of the effort involved. Failure to comply can lead to legal consequences.
Check the mandatory fields –
Step-by-step in the webinar
If you would like to be there or to ask your questions:
Get in touch – the registration details will follow shortly.
FAQ
Can an information request under Art. 15 GDPR be refused due to disproportionate costs?
According to the judgment of the Federal Finance Court described in the article, the answer is basically no. The GDPR does not consider „unreasonable effort“ to be a general ground for denial of requests for information under Article 15 of the GDPR.
Can the exception due to disproportionate costs under Art. 14 GDPR be transferred to Art. 15 GDPR?
Not according to the BFH decision shown. The exception provided for in Art. 14, paragraph 5, letter b of the GDPR applies to certain information obligations under Art. 14 of the GDPR and cannot be applied accordingly to the right to information under Art. 15 of the GDPR.
What consequences does the judgment have for companies?
Companies must be prepared to fully process even extensive requests for information. The organizational or economic effort alone does not justify refusing to provide the information under Article 13 of the GDPR.
