[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdpr65IaI4f_0h_BvSEGojOj9HJoCXOOkkInGsgyCoX0":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"25acceea-bf73-4bcb-b642-c0bf700a2020","VG München - M 32 E 26.3990","vg-munchen-m-32-e-26-3990-ea0ce5","Created page with \"{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=VG München |Court_Original_Name=Verwaltungsgericht München |Court_English_Name=Administrative Court Munich |Court_With_Country=VG München (Germany) |Case_Number_Name=M 32 E 26.3990 |ECLI= |Original_Source_Name_1=openJur |Original_Source_Link_1=https:\u002F\u002Fopenjur.de\u002Fu\u002F2553648.html |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_...\" Show changes","The Administrative Court Munich rejected a data subject's request for access to personal data stored on university professors' work email accounts. The court found that the professors' legitimate interests in communication confidentiality and privacy outweighed the data subject's right of access under GDPR Article 15. The court also noted that employees using work email for private activities generally act as sole controllers.","German court rules professors' privacy outweighs data subject's GDPR access rights.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VG_M%C3%BCnchen_-_M_32_E_26.3990&diff=52851&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-01T07:50:52+00:00","2026-09-01T08:00:15.830238+00:00",7,[17,20,23],{"name":18,"type":19},"work email accounts","product",{"name":21,"type":22},"openJur","vendor",{"name":24,"type":25},"email","technology","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":26,"icon":28,"name":29,"slug":30},null,"GDPR","gdpr",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21,18],{"controls":52,"vendors":53},[],[],{"slug":55,"title":56,"body":57,"framework_refs":58,"framework_notes":69},"munich-court-rules-employee-email-privacy-can-override-gdpr-access-rights","Munich Court Rules Employee Email Privacy Can Override GDPR Access Rights","The Administrative Court Munich ruled that professors' legitimate interests in email confidentiality outweighed a data subject's GDPR Article 15 right of access, highlighting the tension between employee privacy and data subject rights. A critical complicating factor was the blending of professional and private communications on work email accounts, which the court determined made individual employees — rather than the university — the sole controllers of that data. This case illustrates how the absence of clear organizational policies around work email usage can create significant legal ambiguity and expose institutions to complex GDPR disputes. Organizations that fail to establish boundaries between personal and professional use of corporate systems risk fragmenting accountability for personal data, undermining both data subject rights and institutional data governance.",[59,60,61,62,63,64,65,66,67,68],"GDPR Article 15 (Right of Access)","GDPR Article 4(7) (Definition of Controller)","GDPR Article 6(1)(f) (Legitimate Interests)","GDPR Article 26 (Joint Controllers)","NIST SP 800-53 AC-1 (Access Control Policy and Procedures)","NIST SP 800-53 IP-1 (Individual Access)","CIS Control 3 (Data Protection)","CIS Control 14 (Security Awareness and Skills Training)","ISO\u002FIEC 27001 A.6.2.2 (Teleworking and Acceptable Use)","ITIL Service Management – Information Security Policy Governance",{}]