Referral C-672/22 (DKV, 27 Oct 2022)

Must the first sentence of Article 15(3) of the General Data Protection Regulation (GDPR), 1 read in conjunction with Article 12(5) thereof, be interpreted as meaning that the controller (in the present case: the insurer) is also obliged to provide the data subject (in the present case: the policyholder), free of charge, with a first copy of his or her personal data processed by the controller where the data subject does not request the copy in order to pursue the purposes referred to in the first sentence of recital 63 of the GDPR, namely to become aware of the processing of his or her personal data and to be able to verify the lawfulness of that processing, but pursues a different purpose – one which is not related to data protection but is legitimate (in the present case: to verify the effectiveness of increases in a private health insurance premium) – and, if so, is that the case even where the information requested has already been communicated to the policyholder by letter in the procedure for increasing premiums under Paragraph 203 of the Versicherungsvertragsgesetz (Law on insurance contracts; ‘the VVG’)?

If Question 1 is answered in the affirmative: Do personal data within the meaning of point 1 of Article 4 and the first sentence of Article 15(3) of the GDPR include the following information:

a) information concerning premium adjustments that a private health insurer has made to a policyholder’s policy, in particular concerning the amount of the adjustment made and the insurance rates affected; and

b) the wording of the statements of reasons for the premium adjustments (Paragraph 203(5) of the VVG).

3. If Question 1 is answered in the affirmative and Question 2 is also answered in the affirmative in whole or in part: Does a private health insurance policyholder’s entitlement to the provision of a copy of the personal data processed by the insurer also include entitlement to receive a copy of the riders to the insurance policy which the insurer sent to the policyholder when it notified him or her of a premium increase, as well as the accompanying cover letters and supplementary pages, or does it extend only to the provision of a copy of the insured person’s personal data as such, with the insurer which processes the data deciding the manner in which it compiles the data for the policyholder concerned?