# C_2023045EN.01000601.xml

| 6.2.2023 | EN | Official Journal of the European Union | C 45/6 |
| --- | --- | --- | --- |

6.2.2023

EN

Official Journal of the European Union

C 45/6

---

Request for a preliminary ruling from the Oberlandesgericht Koblenz (Germany) lodged on 27 October 2022 — BZ v DKV Deutsche Krankenversicherung AG

(Case C-672/22)

(2023/C 45/11)

Language of the case: German

Referring court

Oberlandesgericht Koblenz

Parties to the main proceedings

Applicant and appellant: BZ

Defendant and respondent: DKV Deutsche Krankenversicherung AG

Questions referred

| 1. | Must the first sentence of Article 15(3) of the General Data Protection Regulation (GDPR), (1) read in conjunction with Article 12(5) thereof, be interpreted as meaning that the controller (in the present case: the insurer) is also obliged to provide the data subject (in the present case: the policyholder), free of charge, with a first copy of his or her personal data processed by the controller where the data subject does not request the copy in order to pursue the purposes referred to in the first sentence of recital 63 of the GDPR, namely to become aware of the processing of his or her personal data and to be able to verify the lawfulness of that processing, but pursues a different purpose — one which is not related to data protection but is legitimate (in the present case: to verify the effectiveness of increases in a private health insurance premium) — and, if so, is that the case even where the information requested has already been communicated to the policyholder by letter in the procedure for increasing premiums under Paragraph 203 of the Versicherungsvertragsgesetz (Law on insurance contracts; ‘the VVG’)? |
| --- | --- |

1.

Must the first sentence of Article 15(3) of the General Data Protection Regulation (GDPR), (1) read in conjunction with Article 12(5) thereof, be interpreted as meaning that the controller (in the present case: the insurer) is also obliged to provide the data subject (in the present case: the policyholder), free of charge, with a first copy of his or her personal data processed by the controller where the data subject does not request the copy in order to pursue the purposes referred to in the first sentence of recital 63 of the GDPR, namely to become aware of the processing of his or her personal data and to be able to verify the lawfulness of that processing, but pursues a different purpose — one which is not related to data protection but is legitimate (in the present case: to verify the effectiveness of increases in a private health insurance premium) — and, if so, is that the case even where the information requested has already been communicated to the policyholder by letter in the procedure for increasing premiums under Paragraph 203 of the Versicherungsvertragsgesetz (Law on insurance contracts; ‘the VVG’)?

| 2. | If Question 1 is answered in the affirmative: Do personal data within the meaning of point 1 of Article 4 and the first sentence of Article 15(3) of the GDPR include the following information:






  a) | information concerning premium adjustments that a private health insurer has made to a policyholder’s policy, in particular concerning the amount of the adjustment made and the insurance rates affected; and |
| --- | --- | --- |

2.

If Question 1 is answered in the affirmative: Do personal data within the meaning of point 1 of Article 4 and the first sentence of Article 15(3) of the GDPR include the following information:

a)

information concerning premium adjustments that a private health insurer has made to a policyholder’s policy, in particular concerning the amount of the adjustment made and the insurance rates affected; and

| b) | the wording of the statements of reasons for the premium adjustments (Paragraph 203(5) of the VVG). |
| --- | --- |

b)

the wording of the statements of reasons for the premium adjustments (Paragraph 203(5) of the VVG).

| 3. | If Question 1 is answered in the affirmative and Question 2 is also answered in the affirmative in whole or in part: Does a private health insurance policyholder’s entitlement to the provision of a copy of the personal data processed by the insurer also include entitlement to receive a copy of the riders to the insurance policy which the insurer sent to the policyholder when it notified him or her of a premium increase, as well as the accompanying cover letters and supplementary pages, or does it extend only to the provision of a copy of the insured person’s personal data as such, with the insurer which processes the data deciding the manner in which it compiles the data for the policyholder concerned? |
| --- | --- |

3.

If Question 1 is answered in the affirmative and Question 2 is also answered in the affirmative in whole or in part: Does a private health insurance policyholder’s entitlement to the provision of a copy of the personal data processed by the insurer also include entitlement to receive a copy of the riders to the insurance policy which the insurer sent to the policyholder when it notified him or her of a premium increase, as well as the accompanying cover letters and supplementary pages, or does it extend only to the provision of a copy of the insured person’s personal data as such, with the insurer which processes the data deciding the manner in which it compiles the data for the policyholder concerned?

---

(1)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).

---