No affidavit regarding information subject to data protection

A tax authority is not required to certify under oath that the information it provided regarding data protection is accurate and complete. In a most recently published judgment, the Supreme Tax Court does not see any legal grounds for this. The court went on to say that it is generally assumed that the information provided is complete and accurate.

The plaintiff requested that the defendant, a tax authority, provide him with information regarding the processing of personal data concerning his person (Article 15 of the General Data Protection Regulation—GDPR). The defendant complied with this request. The plaintiff questioned the accuracy and completeness of the information provided. He therefore demanded that the defendant issue a corresponding affidavit which the latter refused. The tax court of first instance dismissed the appeal against this decision.

The Supreme Tax Court agreed and noted, first, that the General Data Protection Regulation does not contain any provision requiring the data controller to certify under oath the accuracy and completeness of information provided pursuant to Article 15 of the GDPR.

Nor can such an obligation be derived from the civil law provisions on affidavits pursuant to Section 259 (2) and Section 260 (2) of the German Civil Code (for example, in cases of suspected misleading or negligent disclosure). The Supreme Tax Court raised doubts if, in light of the self-contained regulatory framework of the General Data Protection Regulation, it might be possible at all to rely on provisions outside the scope of that regulation. In any case, according to the Supreme Tax Court, this does not apply to data protection-related claims for information against a tax authority.

Furthermore, the authorities are anyway legally obligated to provide complete and accurate information. If there is reason to believe that the information was not provided with the utmost care, the person entitled to the information may demand from the authority to provide complete and accurate information. In the opinion of the Supreme Tax Court, this claim would be undermined if the authority could resort to a formal affidavit stating that it had no personal data - or no further personal data - regarding the person in question.

Also, the Supreme Tax Court did not agree with the plaintiff’s assertion that this constituted a violation of EU law. Given the clear legal situation here, the Supreme Tax Court saw no reason to refer the matter to the European Court of Justice for a preliminary ruling.

Source: Supreme Tax Court, judgment of 30 June 2026 (IX R 2/25) published on 10 September 2026.