Right to information also applies to call notes and telephone memos

Björn Holeschak, Leiter Datenschutz EIKONA Systems GmbH
Woman sits on sofa with laptop on lap and makes phone call, which stands for the right to information for call notes

In the meantime, the Regional Court of Cologne has ruled for the second time that the right to information under Art. 15 DSGVO is to be understood comprehensively and also covers mere notes of conversations and telephone notes (Regional Court of Cologne, judgment of 11.11.2020 - Ref.: 23 O 172/19). In a legal dispute, the plaintiffs asserted a claim for information against their health insurance company pursuant to Art. 15 DSGVO. According to the Regional Court of Cologne, this claim covered all information about a person.


Reasons for judgement right to information

"The provision thus covers both personal information used in context, such as identification features (e.g. name, address and date of birth), external characteristics (such as gender, eye colour, height and weight) or internal states (e.g. opinions, motives, wishes, convictions and value judgements), as well as all information, such as asset and property relationships, communication and contractual relationships and all other relationships of the persons concerned with third parties and their environment (...)".

In particular, memos of conversations and telephone notes were also covered:
"The plaintiffs' request for information thus also includes in particular all the elements listed in the application (...), as well as the notes of conversations and telephone notes which were raised several times in the legal dispute. (...) In this respect, it should be noted that the DSGVO only contains a limited set of facts in the context of Art. 12(5), which intervenes in the case of "manifestly unfounded or - (...) - excessive requests by a data subject". There can be no question of the existence of these conditions with regard to the rights of access asserted by the plaintiffs".


Restrictions on the insurance industry are not effective

The health insurance company tried to exempt itself from the completeness of the documents to be disclosed with the regulations regarding the information restrictions in relation to the "Code of Conduct of the Insurance Industry". However, the court ruled that the deviating assessments could not be invoked as a restriction, because there was no sufficient legal authorisation for this:

"Insofar as the defendant referred in this context to Article 40 DSGVO and the related "Code of Conduct for the Handling of Personal Data by the German Insurance Industry" (so-called Code of Conduct - CoC), it cannot prevail with this objection. It is evidently contrary to the meaning and purpose of the provisions of the DSGVO and, in this context, the broad concept of "personal data" under Article 4 of the DSGVO, if "associations and other organisations" were entitled to limit the content of the right to information under Article 15 of the DSGVO. Such a power is also not to be inferred from Art. 40 DSGVO, which refers in particular to certain "rules of conduct"."


Appropriate technology is obligatory

The court also did not accept the objection that the request was disproportionate and thus an abuse of rights. In principle, it was the task and duty of the processing agency to operate a sufficient technical system so that the data could be disclosed without far-reaching problems:

"The asserted request for information is furthermore in no case "disproportionate" as the defendant thinks with regard to the large number of its policyholders (....)."

Further, the chamber states, referring to a ruling of the Higher Regional Court of Cologne: "It is up to the defendant, who uses electronic data processing, to organise it in accordance with the legal system and, in particular, to ensure that data protection and the resulting rights of third parties are taken into account."


Conclusion

Don't forget the right to information

The new standard brings exciting advantages, which we will continue to monitor. If you are interested, we would be happy to examine your individual situation to see whether it makes sense for you to switch in the future. Because, in order to be able to use the new WLAN standard in all its advantages, components of the network must be replaced. In this context, Wi-Fi 6 certified end devices make sense so that the new functions can be fully used.


Björn Holeschak
Björn Holeschak
Team Lead, Data Protection

Drawing on his profound data protection expertise, he tackles data protection challenges with renewed vigor every single day. He understands the dangers and stumbling blocks in intimate detail and gives customers practical advice.


Add a comment

Please add 4 and 3.