Introduction 

Providing information under Article 15 of the General Data Protection Regulation (GDPR) presents significant technical and legal challenges for companies, especially those with many natural persons as customers. In practice, self-service tools are often used to meet these requirements. However, there is some legal uncertainty about whether the provision of such self-service tools fulfills the requirements of Article 15 GDPR. On July 2, 2024, the Higher Regional Court (HRC) of Frankfurt a. M. decided (Case No. 6 U 41/24) that the provision of a self-service tool satisfies the right to access under Article 15 (2) GDPR:

Key Facts 

A user of a social media platform took legal action against the platform operator for an alleged violation of the GDPR. Specifically, the plaintiff accused the operator of not fully complying with his right to access under Article 15 GDPR. The operator had not provided the plaintiff's personal data through a separate communication channel but had instead referred them to the self-service tool. The plaintiff argued that this did not sufficiently fulfill the legal right to access and filed a lawsuit.

Court´s decision

The HRC Frankfurt a. M. ruled that the provision of a self-service tool meets the right to access under Article 15 GDPR. Users can independently view and retrieve a copy of their personal data from their residence through the tool. The copy meets the legal requirements of Article 15 (3) sentence 1 GDPR and is also considered the preferred form of transmission (see also OLG Dresden, judgment of December 5, 2023, Case No. 4 U 1094/2).

According to the court, the right to access is properly fulfilled at the correct location if the plaintiff's residence is considered the place of fulfillment. This does not contradict the provisions of Recital 63 of the GDPR. The argument that referring to a self-service tool is insufficient for individuals without IT knowledge or access to digital services was also dismissed. The court argued that registering on a platform already requires basic IT knowledge, so registered users cannot be considered inexperienced. Therefore, a user of a social media platform logically does not live an analogue life.

Impact on Online Businesses

According to the HRC Frankfurt a. M., self-service tools are an appropriate and legally compliant form of data access, which will play a significant role in the future. Also the European Data Protection Board stated in its Guidelines 01/2022 on data subject rights - Right of access from March 28, 2023, that such self-service tools can provide sufficient information in the sense of Article 15 GDPR. Platform operators thus have the opportunity to fulfill their obligation to provide access rights with precise internal processes and without significant effort for support staff. At the same time, users benefit as they receive information about their stored personal data more quickly, minimizing waiting times.