Purpose
Art. 15 requests are often preparation for a claim (damages under Art. 82 GDPR, applicant discrimination, employee dispute). This skill checks identity, scope and deadlines and drafts a complete, neither over- nor under-inclusive response.
Inputs
- Mandate (controller)
- Requester (identity, relationship to the controller)
- Time of request (start of deadline)
- Known processing operations (CRM, marketing, HR, accounting)
- Prior history (application rejected? Termination? Dispute?)
Procedure
1. Identity verification (Art. 12(6) GDPR)
If there are justified doubts, request proof of identity. Proportionate: date of birth + address, not a blanket copy of ID (EDPB Guidelines 01/2022).
2. Deadlines (Art. 12(3) GDPR)
- 1 month from receipt, extension by 2 months in case of complexity (with reasons provided to the data subject before the end of the first month).
- Acknowledgement of receipt recommended immediately.
3. Scope (Art. 15(1)(a)–(h) GDPR)
Information about:
a) purposes of processing b) categories of personal data c) recipients / categories of recipients (in particular third-country recipients) d) envisaged storage period / criteria e) right to rectification, erasure, restriction, objection f) right to lodge a complaint with a supervisory authority g) origin, where the data were not collected from the data subject h) automated decision-making / profiling (Art. 22)
4. Data copy (Art. 15(3) GDPR)
Copy of all processed data, insofar as they do not fall within the scope of the restrictions (Art. 15(4) GDPR; § 34 BDSG).
Format: machine-readable or readable PDF; for electronic requests, electronically by default.
5. Restrictions (Art. 15(4) GDPR; § 34 BDSG)
- The rights and freedoms of others must not be impaired (in particular trade secrets, third-party data).
- Special exceptions under § 34(1) BDSG (information contrary to lawyer's duty of confidentiality / pseudonymisation / retention vs. erasure obligation).
6. Cost-free nature / exceptions Art. 12(5) GDPR
In principle free of charge. For manifestly unfounded / excessive requests: reasonable fee or refusal; burden of proof on the controller.
7. Special cases of employee data protection
§ 26 BDSG. Information about internal assessments (application notes) is disputed — prevailing view: yes, insofar as not a trade secret. In an ongoing employment relationship: observe the works council's additional right to lodge a complaint under § 80 BetrVG.
Sources
Statutes
- Art. 15 GDPR (information)
- Art. 12 GDPR (procedure)
- Art. 82 GDPR (Damages)
- § 34 BDSG (Restrictions)
- § 26 BDSG (Employee Data)
Guidelines
- EDPB Guidelines 01/2022 on data subject rights – https://edpb.europa.eu/
Case Law
- CJEU, judgment of 04.05.2023 – C-487/21, NJW 2023, 2186 (extensive data copy)
[unverifiziert – prüfen] - CJEU, judgment of 26.10.2023 – C-307/22, NZA 2023, 1429 (information in an employment relationship)
[unverifiziert – prüfen] - BAG, judgment of 27.04.2021 – 2 AZR 342/20, NZA 2021, 1233 (applicant information)
[unverifiziert – prüfen]
Output Format
DSGVO-AUSKUNFTSERSUCHEN – Antwortentwurf — <Mandat-ID> — <Datum>
I. Identitätsprüfung [✅ / ⚠️ Nachweis verlangt]
II. Fristprüfung Eingang: <Datum> | Fristende: <+1 Monat>
III. Umfang (Art. 15 Abs. 1)
a) Verarbeitungszwecke <…>
b) Datenkategorien <…>
c) Empfänger <…>
d) Speicherdauer <…>
e) Betroffenenrechte (Standardpassus)
f) Beschwerderecht (Standardpassus)
g) Herkunft <…>
h) Profiling / autom. Entscheidung <…>
IV. Datenkopie (Art. 15 Abs. 3)
Anlage: <Liste>
Beschränkungen (Art. 15 Abs. 4 / § 34 BDSG):
- <…>
V. Offene Punkte
- <…>
Empfehlung: <…>
Risks / Typical Errors
- Deadline missed → possibly damages under Art. 82 GDPR, complaint to the supervisory authority.
- Over-disclosure → violation of third-party rights (Art. 15(4)) → own liability.
- Under-disclosure → repeat request + threat of damages.
- Identity verification overlooked → data disclosure to unauthorized parties (Art. 32 GDPR violation).
- Trade secrets not redacted → § 17 UWG / Art. 15(4) violation.