VG München - M 32 E 26.3990

Summary

The Administrative Court Munich rejected a data subject's request for access to personal data stored on university professors' work email accounts. The court found that the professors' legitimate interests in communication confidentiality and privacy outweighed the data subject's right of access under GDPR Article 15. The court also noted that employees using work email for private activities generally act as sole controllers.

Full text

Help VG München - M 32 E 26.3990: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 07:50, 1 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators150 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 07:50, 1 September 2026 VG München - M 32 E 26.3990 Court: VG München (Germany) Jurisdiction: Germany Relevant Law: Article 4(7) GDPR Article 15 GDPR Article 23(1)(i) GDPR § 123(1)(1) VwGO§ 10(2)(3) BayDSG Decided: 11.08.2026 Published: 25.08.2026 Parties: National Case Number/Name: M 32 E 26.3990 European Case Law Identifier: Appeal from: Appeal to: Unknown Original Language(s): German Original Source: openJur (in German) Initial Contributor: av A court held that the data subject had no right of access to personal data stored on the work email accounts of two university professors: the professors’ legitimate interests in the confidentiality of their communication and their right to privacy outweighed the right of access. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a private publishing company and overseen by several co-editors, including two professors at a Bavarian university (the alleged controller). The data subject received an email pointing out inconsistencies in the external review process in April 2026. On 7 May, the data subject submitted an access request under Article 15 GDPR to the university and requested a complete copy of their personal data processed in connection with the publishing process. The work email accounts of the two aforementioned university professors were explicitly identified as storage locations in the access request. The university rejected the access request in a decision dated 20 May 2026: it argued that it was not the controller within the meaning of Article 4(7) GDPR. According to the university, only the co-editors of the journal and the publishing company could be classified as controllers with regard to the storage of personal data in connection with publishing activities. On 26 May, the data subject filed a both a lawsuit and an application for a preliminary injunction before the Administrative Court Munich. In the application, they requested a preliminary injunction ordering the university to retain all the data subject's personal data until the main proceedings regarding the right to access would be legally concluded. As the data subject sought to secure their right of access with the application, they argued that their right to a preliminary injunction arose from Articles 5(2), 15, and 32 GDPR. Holding The court rejected the data subject's application for a preliminary injunction: the requirements laid down in § 123(1)(1) of the German Code of Administrative Court Procedure (VwGO) were not fulfilled. First, the court held that the role of the university in the processing at issue could be left open in connection with the application for a preliminary injunction. Instead, it should be determined in the main proceedings whether the university was acting as a controller within the meaning of Article 4(7) GDPR. The court pointed out, however, that an employee using a work email account to process personal data in connection with their private activities generally determines the purpose and the means of the processing and is therefore acting as the sole controller. Second, the court concluded that the data subject did not have a right of access under Article 15 GDPR. The court weighed the data subject's right to access against the university professors' legitimate interests in maintaining the confidentiality of their communication and their general right to privacy. As the requested disclosure of information would constitute a significant infringement of the professors' right to privacy, the court held that the legitimate interests of the university professors prevailed over the data subject's right of access. According to the court, this conclusion was supported by Article 23(1)(i) GDPR and Article 10(2)3) of the Bavarian Data Protection Act (BayDSG), as these provisions restrict the right of access. The national provision states that information shall not be disclosed to the extent that personal data or the fact of its storage must be kept confidential to protect the data subject or due to the overriding legitimate interests of third parties. The court also referred to Article 15(4) GDPR to support its argumentation. Pursuant to this provision, the right to receive a copy of personal data processed shall not adversely affect the rights and freedoms of others. In addition, the court pointed out that Article 15 GDPR must be interpreted in light of the fundamental rights guaranteed in the EU Charter. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Munich Administrative Court, Order of August 11, 2026 - M 32 E 26.3990 Citation openJur 2026, 8913 Legal Effect: Operative Part I. Prof. Dr. ... ... and Prof. Dr. ... ... are summoned to appear. II. The motion is denied. III. The petitioner shall bear the costs of the proceedings. IV. The amount in dispute is set at €2,500. Reasons I. In the present proceedings, the petitioner essentially seeks an order requiring the respondent to delete the data sets pertaining to a manuscript—submitted to the editorial office of a quarterly journal—from the emailmailboxes of specifically named university professors until the final resolution of the lawsuit pending before the Munich Administrative Court under case no. M 32 K 26.3986. On November 16, 2025, the petitioner submitted the manuscript “Bold Transformations: Forms of Virtuality and Processes of Transformation in German Literature around 1800” for review. The DVjs is published by Springer Nature and is overseen by several co-editors, including Prof. Dr. ... ... (Chair of Modern German Literature, ... ...) and Prof. Dr. ... ... (also ... ...). On April 22, 2026, the applicant received an email from Prof. Dr. ... pointing out “implausibilities” regarding the external review process. The sender’s email address is listed as: “...”. In a letter dated May 7, 2026, the applicant submitted an access request pursuant to Article 15 of the GDPR to the respondent. The subject of the request is the provision of information and the transmission of a complete copy of all of the applicant’s personal data processed within the respondent’s sphere of responsibility in the context of or in connection with the aforementioned matter. The letter explicitly identifies the work email accounts of Prof. Dr. ... and Prof. ... ... as relevant data storage locations. It covers all email correspondence in which the applicant is mentioned by name or in connection with the aforementioned manuscript or the procedural complaint dated April 23, 2026, all internal opinions, statements, file notes, and annotations, as well as the information specified in Article 15(1) of the GDPR regarding processing purposes, recipients, retention periods, and the origin of the data. In a decision dated May 20, 2026, issued by the respondent’s data protection officer, the respondent refused to provide the information on the grounds that it was not the controller within the meaning of Article 4(7) of the GDPR. On May 26, 2026, the petitioner filed a lawsuit against the respondent and simultaneously requested that that the respondent be ordered by way of a preliminary injunction to disclose all of the applicant’s personal data within the respondent’s sphere of responsi

Entities