Deadline to file an appeal for provision of personal data under Article 15 GDPR

In a recent judgement, the Supreme Tax Court held that the only legitimate type of action for the judicial claim under the General Data Protection Regulation (GDPR) for the provision of a copy of the processed personal data is by way of „appeal for mandatory relief" (Verpflichtungsklage). The filing deadline is one month commencing with the delivery of the challenged administrative act.

I. Section 55 (1) and (3) and Section 47 (1) of the Code of Procedure of Fiscal Courts (Finanzgerichtsordnung - FGO)

Section 55 FGO states that

(1) The deadline for an appeal shall only commence if the party concerned has been informed in writing or electronically about the right of appeal, the authority or court to which the appeal is to be filed, and the deadline to be observed.

(2) If the information has not been provided or has been provided incorrectly, the appeal may only be filed within one year of notification

Section 47 (1) FGO reads as follows:

The filing deadline to submit an action for judicial review of an administrative decision (Anfechtungsklage) shall be one month; it shall commence upon notification of the out-of-court decision, in the cases of Section 45 and in cases in which there is no extrajudicial legal action upon notification of the administrative act. This shall apply mutatis mutandis to the action for mandatory relief (Verpflichtungsklage) if the application to carry out the administrative act has been rejected.

II. Case of dispute and decision of the Supreme Tax Court

In the case of dispute, the plaintiff did not file an action before the tax court until after one year had passed since the tax office had rejected his request for information of the processed personal data. On 25 September 2019, the plaintiff asked the tax office to provide information in accordance with Art. 15 (1) GDPR and to submit corresponding copies in accordance with Art. 15 (3) GDPR. The tax office did not fully comply with this request.

In an action filed with the lower tax court on 25 February 2021, the plaintiff requested that the tax office be ordered to provide complete information about personal data and information within the meaning of Section 15 (1) and (3) GDPR. Furthermore, he believed the General Data Protection Regulation does not set a deadline for filing a lawsuit. The entitled party can assert its right for information at any time and repeatedly.

The Supreme Tax Court held that the plaintiff had filed a late complaint with the tax court. This applies even though no explanations of the procedures for legal remedies were attached, namely with information about the possibility to appeal, the revenue authority where an appeal must be filed, the location of the revenue authority, and the deadline for lodging the appeal.

The Supreme Tax Court clarifies that an appeal for information pursuant to Art. 15 GDPR cannot be brought independently of the deadlines set out in Section 47 (1) or Section 55 (2) sentence 1 of the Code of Procedure of Fiscal Courts (FGO). Neither the GDPR nor the principles of equivalence and effectiveness under EU law imply that such an action must be possible “at any time”.

If the prescribed information about the right of appeal has been omitted - as in the case of dispute - the deadline for filing the action for mandatory relief follows from Section 55 (2) sentence 1 FGO. Accordingly, the appeal may only be filed within one year of notification, unless, among other things, it was impossible to file the appeal before the expiry of the one-year period due to force majeure or written or electronic notification was given that there was no right of appeal.

The conclusion of the Supreme Tax Court is in line with the opinion of the Federal Administrative Court on the question of the general deadline as such. Therefore, the deadline of one month as stipulated in Section 47 (1) FGO applies.

There is no need for a referral to the ECJ in the present proceedings. The legal situation is unambiguous (“acte clair”) and has already been clarified by the ECJ's case law in a way that leaves no reasonable doubt (e. g. ECJ, judgment Srl CILFIT and Lanificio di Gavardo SpA v Ministry of Health of 6 October 1982 C-283/81, para. 14). The ECJ also held that it is for the referring court to determine, based on the national procedural provisions, how the remedies provided for by the GDPR are to be pursued.

Source:

Supreme Tax Court decision of 6 May 2025 IX R 2/23 - published on 12 June 2025.