The Cologne regional court clarifies the definition of personal data – 20 U 75/18, 26 July 2019
In Germany, a recent decision of the Cologne Regional Court required an insurer to provide one of its insureds with all the information it held on him. The decision was in respect of an insurance company, but is likely to extend to all distributors of insurance products.
Decision
The judges confirmed the insured’s right to obtain from the company all personal data it held about him, on the basis of the insured’s right to information. The Cologne Regional Court held that all data, including conversation notes and telephone notes concerning the applicant, as well as recorded statements by or about the applicant, were personal data and should therefore be disclosed to the applicant under GDPR.
CGPA comments
According to the court, any information/data concerning an identified or identifiable natural person must be considered to be personal data, and the insurance company cannot assert business secrecy to avoid disclosing it to the insured. This decision therefore reshapes the contours of the definition of personal data processing, in particular due to the development of information technology and the vast possibilities it offers. It does not concern only insurers but would certainly apply to insurance intermediaries if a similar case were to come before the courts.