The right to information under General Data Protection Regulation for board members and managing directors

According to Art. 15 Para. 1 Clause 1 GDPR, the „data subject“ can request information from the data controller (Art. 4 No. 7 GDPR) as to whether their data has been processed. If this is the case, the data subject has a right to information about this data. In addition, this person has a right to receive copies of the processed data in accordance with Art. 15 para. 3 GDPR.

The ECJ treats these elements as part of a uniform, comprehensive „right of access to information“ (ECJ, judgment of 12 January 2023 – C-154/21 „Österreichische Post AG“; judgment of 26 October 2023 – C-307/22 – „FT/DW“). This claim is not only available to employees, but also to board members and managing directors (OLG Nuremberg, judgement of 29 November 2023 – 4 U 347/21). In practice, this can be advantageous for board members and managing directors. Or, from the company’s point of view, lead to considerable effort, knowing that the motivation for providing information could lie „elsewhere“.

Eligibility requirements

The right of access under Art. 15 GDPR has only a few requirements. It is sufficient that the data subject’s personal data has been processed (Art. 4 No. 1, 2 GDPR) and the data subject submits a request for information.

Claim content

Standardised, comprehensive right of access to information

How the claim is to be fulfilled depends on Art. 12 GDPR. The ECJ assumes a comprehensive right of access to information. The purpose of the claim is to enforce data protection claims (e.g. for the erasure of information, Art. 17 GDPR; for compensation due to unauthorised data processing, Art. 82 GDPR). The data subject can only exercise their rights effectively if they receive complete and correct data. In addition to the right to information, the data subject also has the right to receive copies in accordance with Art. 15 para. 3 GDPR. However, the ECJ does not see this as a claim in itself, but merely a modality of fulfilment of the claim.

Scope of the right of access to information

Art. 15 para. 1 2nd half-sentence GDPR contains a list of information that must be provided. According to Art. 4 No. 1 GDPR, „personal data“ means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The ECJ gives the term „personal data“ a broad meaning and considers it to include all types of information, both objective and subjective, in the form of opinions or judgements. The only requirement is that it is information „about“ the person in question. There is no restriction to sensitive or private information. The information only needs to be linked to an identifiable person due to its content, purpose or effects.

Linking information with board members or managing directors

Board members or managing directors are connected to a lot of information. Depending on the organisation of the company, a board member or managing director may be linked to all documents that leave the company (emails, faxes, letters, etc.). Mere mention on the letterhead or in the signature of emails will (probably) not be sufficient. E-mail correspondence or entries in electronic and physical calendars and minutes are to be assessed differently. In these cases, such a link must be assumed. Signatures in facsimile are unclear. These could be „linked“ information – with all the consequences for the right to information.

In line with Art. 15 para. 1 GDPR, there is the right to receive copies in accordance with Art. 15 para. 3 GDPR. Directors or managing directors have the right to receive a faithful and intelligible reproduction of their personal data. The ECJ even grants the right to request not only a copy of the personal data that is the subject of the processing, but also a copy of extracts from documents or even entire documents or extracts from databases that contain this data. The only requirement is that the provision of such a copy is essential to enable the data subject to effectively exercise the rights conferred on them by this Regulation

Limits of the claim

Even if the right of access to information is regarded as comprehensive, it has limits.

Rights of third parties pursuant to Art. 15 para. 4 GDPR and Art. 29 para. 1 sentence 1 BDSG

Limits are the rights of third parties in accordance with Art. 15 para. 4 GDPR and Art. 29 para. 1 sentence 1 BDSG.

According to Art. 15 para. 4 GDPR, the right to information may be restricted if the rights and freedoms of other persons are affected. This includes, in particular, copyrights, the general right of personality and data protection of third parties, but also the protection of business secrets. A proportionality test must be carried out here. In particular, the right to information must be weighed against the rights of third parties. A (partial) redaction can be a milder means.

The claim may be excluded in accordance with Art. 29 para. 1 sentence 2 BDSG if the information would disclose information that must be kept secret in accordance with a legal provision or by its nature, in particular due to the overriding legitimate interests of a third party.

Disproportionate effort to fulfil the right to information

In practice, responding to the claim can generate considerable effort for the controller. However, there is no general reason for exclusion due to disproportionate compliance costs. The effort required by the controller is therefore irrelevant for Art. 15 GDPR.

„manifestly unfounded or excessive requests“ within the meaning of Art. 12 (5) GDPR

Pursuant to Art. 12 (5) GDPR, the controller may either demand reasonable compensation or even refuse to take action in the case of manifestly unfounded or – especially in the case of frequent repetition – excessive requests by a data subject.

However, these exceptions must be interpreted restrictively. Manifestly unfounded means that a claim certainly does not exist. This will hardly ever apply to requests for information under Art. 15 GDPR.

The claim is also not subject to any earmarking. The motivation of the data subject is irrelevant. Using the right to information, the data subject can pursue motives unrelated to data protection, such as obtaining information for settlement negotiations or retrieving contractual details that are no longer available (e.g. account information, insurance conditions, etc.).

Legal consequence of a breach of the duty to provide information: compensation (Art. 82 GDPR)

Contrary to the case law of some lower courts, a breach of the duty to provide information pursuant to Art. 15 GDPR may give rise to a claim for damages by the data subject pursuant to Art. 82 GDPR. According to Art. 82 para. 3 GDPR, the responsibility of the defendant for the breach is presumed.

Conclusion

The ECJ considers the right of access under Art. 15 GDPR to be a comprehensive right of access to information. In addition to the right to information, there is also a right to be provided with copies. In the case of board members and managing directors, this can lead to considerable effort for the company, as the management is associated with a large amount of information. As is so often the case:

For board members and managing directors, this entitlement can be of considerable benefit when negotiating with the company about their departure and/or a severance payment.

For companies, the situation is exactly the opposite. They have to make a considerable effort and have no benefit.

The author of this article will be happy to answer any questions you may have regarding the right of access to information in accordance with Art. 15 GDPR or its defence and will help you to assert your interests.

---

Authors: Dr. Andreas Menkel, Florian Wenzel