VG München - M 32 E 26.3990
German court rules professors' privacy outweighs data subject's GDPR access rights.
The Administrative Court Munich rejected a data subject's request for access to personal data stored on university professors' work email accounts. The court found that the professors' legitimate interests in communication confidentiality and privacy outweighed the data subject's right of access under GDPR Article 15. The court also noted that employees using work email for private activities generally act as sole controllers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run openJur?
Get an email when a new story names openJur, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Administrative Court Munich ruled that professors' legitimate interests in email confidentiality outweighed a data subject's GDPR Article 15 right of access, highlighting the tension between employee privacy and data subject rights. A critical complicating factor was the blending of professional and private communications on work email accounts, which the court determined made individual employees — rather than the university — the sole controllers of that data. This case illustrates how the absence of clear organizational policies around work email usage can create significant legal ambiguity and expose institutions to complex GDPR disputes. Organizations that fail to establish boundaries between personal and professional use of corporate systems risk fragmenting accountability for personal data, undermining both data subject rights and institutional data governance.