| The GDPR grants data subjects extensive rights in relation to the processing of their personal data. In addition to the right to be forgotten, data subjects are particularly entitled to a comprehensive right of access under art. 15 GDPR. In its recently published judgement of 14 January 2025 (case no. IX R 25/22), the German Federal Fiscal Court (Bundesfinanzhof), the supreme court for tax and customs matters in Germany, addressed the conditions under which a request based on this right of access can be refused. Such a refusal is explicitly permitted under art. 12(5) GDPR and concerns manifestly unfounded requests or such of an excessive, repetitive character. The case underlying the Federal Fiscal Court’s ruling concerned an access request filed by a director of a publicly traded company against his competent German tax office. The tax office did not fully comply with the access request, citing an excessive administrative burden. The Federal Fiscal Court ruled that such a burden alone does not constitute sufficient grounds for refusing the right of access, as this would risk undermining the right. From a practical perspective, the ruling emphasises that GDPR-related data access requests must generally be fully complied with. (Dr. Lukas Mezger, Unverzagt Rechtsanwälte) |