When the Bank Knows More: Why Fraud Victims Need Their Right of Access

AG Charlottenburg (Berlin), judgment of 30 September 2026, 211 C 30/26, ECLI:DE:AGBECH:2026:0930.211C30.26.00 · Bundesverwaltungsgericht (Austria), judgment of 2 October 2026, W101 2326844-1/9E · EFRI Case Note, 22 October 2026

Article 15 of the EU General Data Protection Regulation gives every person the right to ask a company — including their own bank or payment service provider — whether it processes personal data about them and, if so, to receive a free copy of that data together with information on why it is used, where it came from and to whom it has been disclosed.

Deadlines and complaints: The bank or payment service provider must respond without undue delay and in any event within one month of receiving the request; this period can be extended by two further months only where necessary in view of the complexity and number of requests, and the requester must be informed of any extension, with reasons, within the first month (Article 12(3) GDPR). If the request is refused, answered incompletely or ignored, the requester can lodge a complaint with a data protection supervisory authority in particular in the Member State of habitual residence, place of work or place of the alleged infringement (Article 77 GDPR) — or go to court (Article 79 GDPR).

How EFRI uses Article 15

For EFRI, Article 15 is a standard tool. We use access requests in our own work on fraud cases, and we consistently advise victims to send them both to their own bank and to the payment service providers through which their money was routed. A victim often knows only her own transfers; the records of the institutions that processed them are the first source for understanding what happened to the money and how the payments were handled. In our experience to date, these requests have been answered without difficulty.

What Article 15 lets you ask for — and what it does not

What you are entitled to. Article 15 GDPR gives the person concerned (the “data subject”) the right to:

Confirmation whether personal data about her are being processed at all, and, if not, a confirmation of that as well (Article 15(1), first part).
Access to the personal data themselves (Article 15(1)).
The following information (Article 15(1)(a)–(h)):
- (a) the purposes of the processing;
- (b) the categories of personal data concerned;
- (c) the recipients or categories of recipients to whom the data have been or will be disclosed, in particular recipients in third countries or international organisations;
- (d) where possible, the envisaged storage period or, if not possible, the criteria used to determine it;
- (e) the existence of the rights to rectification, erasure, restriction of processing and objection;
- (f) the right to lodge a complaint with a supervisory authority;
- (g) where the data were not collected from her, any available information on their source;
- (h) the existence of automated decision-making, including profiling, under Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as its significance and envisaged consequences.
Information on safeguards where data are transferred to a third country or an international organisation (Article 15(2), referring to Article 46).
A copy of the personal data undergoing processing (Article 15(3)). The first copy is free; for further copies a reasonable fee based on administrative costs may be charged. If the request is made electronically, the copy is to be provided in a commonly used electronic format unless otherwise requested.

What this can mean for a fraud victim. Depending on what the institution actually holds, the personal data may include account and transaction data; timestamps, channel, device and authentication data relating to the payment orders; risk scores, alerts or flags generated for her payments; notes of calls, complaints or fraud reports; records of recall requests; and under point (c) the recipients to whom her data were disclosed, such as the payee’s payment service provider.

What you are not entitled to. The right has limits, and victims should know them:

Suspicious transaction reports (SARs). A bank will not disclose whether it has filed a suspicious transaction report, what it said, or what followed. In Germany, § 47(1) GwG prohibits obliged entities from informing the customer, the person ordering the transaction or any other third party of an intended or submitted report under § 43(1) GwG, of investigations opened on the basis of such a report, or of an information request under § 30(3) GwG (the “tipping-off” prohibition, implementing Article 39(1) of Directive (EU) 2015/849). In addition, § 11a(2) GwG excludes the right of access under Article 15 GDPR for personal data that obliged entities transmit for anti-money-laundering purposes to supervisory authorities or the Financial Intelligence Unit. From 10 July 2027, the EU Anti-Money Laundering Regulation (EU) 2024/1624 continues the prohibition of disclosure at EU level. The prohibition protects the report and its consequences — not every record the bank holds. Transaction data, fraud-prevention assessments and customer notes that exist independently of a report are not excluded automatically; the bank must assess what disclosure would actually reveal.
Other limits. The copy must not adversely affect the rights and freedoms of others (Article 15(4)): data concerning only the payee, or in principle the identity of individual bank employees (C‑579/21 Pankki S), are not covered, while records concerning both the victim and another person require assessment rather than automatic exclusion. There is no right to a bank’s full detection rules or algorithm; where Article 22 applies, however, a meaningful explanation of the procedure and principles actually applied is owed, and where trade secrets are invoked, the supervisory authority or court must examine the information and balance the interests (C‑203/22 Dun & Bradstreet Austria, 27 February 2025, paras 58–66 and 67–75). The right concerns personal data, not files: extracts or whole documents are owed only where indispensable to make the data intelligible and the rights effective (C‑487/21, 4 May 2023), and the institution need not create a new forensic analysis or legal assessment. Manifestly unfounded or excessive requests may be refused or charged for, with the burden of proof on the institution (Article 12(5); C‑526/24 Brillen Rottler, discussed below); reasonable doubts about the requester’s identity allow a request for additional information (Article 12(6)); and Member States may restrict the right under Article 23 GDPR in Germany, for instance, §§ 29 and 34 BDSG.

The question is now being debated, however, and the outcome matters to victims. Two recent decisions (one in Berlin, one in Vienna) have restricted access where the data were sought in connection with a civil claim. They are discussed below.

The two decisions

Can a victim of investment fraud use this right to learn how her bank processed the payments that cost her money? The Amtsgericht Charlottenburg said no: obtaining data to substantiate a liability claim against the bank is, in its reasoning, not a purpose of the GDPR. Two days later, the Austrian Federal Administrative Court (BVwG) held standardised access requests to be abusive, citing their exclusive civil-refund purpose, the template-based approach and the commercial representation model behind them.

Neither court is a court of last instance. The Berlin ruling is a first-instance civil judgment; its appeal status is not known to us. The BVwG expressly admits an appeal on points of law (ordentliche Revision) to the Supreme Administrative Court (VwGH) on precisely this question. Together, however, the two decisions illustrate a line of reasoning that, if it hardens, would turn a victim’s intention to seek redress into a reason to deny her access to her own data.

The Berlin case

The claimant used her current account at the defendant bank for everyday expenses. Contacted via social media by a purported London-based platform, she authorised four SEPA credit transfers between 5 and 22 May 2025: €55, €500, €500 and €2,300. The judgment states a total of €3,552, although these amounts add up to €3,355; the discrepancy cannot be resolved from the published text. The payment references read “Kryptographie test” and “Krypto” for the first two transfers and only her name thereafter. The payee account was a Maltese IBAN in her own name at a crypto on-/off-ramp provider, from which the funds were converted into crypto-assets and moved to wallets associated with the alleged fraudulent platform or persons connected with it (paras 1–4).

She sued for €3,552, for €2,975 for a 34-page “forensic tracing report” prepared by her lawyers, for €656.58 in pre-trial legal fees and — in the same action — for access under Article 15 GDPR.

What exactly was requested. The access claim (para 11) asked the court to order the bank:

to provide information under Article 15(1) and (3) GDPR on all personal data concerning the claimant processed in connection with her current account (identified by number) and the transfers of 5, 7 and 22 May 2025;
in particular all system logs (logfiles), extracts from internal monitoring systems (AML and fraud monitoring), internal notes and case-handling records relating to these transactions;
and to transmit a complete copy in a commonly used electronic format.

The request followed directly from her liability theory. She argued that her transfers should have triggered an alert in the bank’s AML/fraud-monitoring system, that the bank should then have delayed execution and contacted her, and that a warning would have stopped her from paying (para 6). Each requested category goes to that question: logs can show when and how each payment order was received, authenticated and executed; monitoring extracts can show whether — and with what score or rule result — the transfers were assessed; internal notes and case records can show whether anyone at the bank looked at them. These are the only sources from which a customer can learn whether the bank’s systems noticed anything.

The bank’s answer was brief: nothing in the transfers indicated a crypto connection or structured investment fraud, and its fraud monitoring “had not been triggered” (para 14). Its counsel repeated in the oral hearing that the system had not responded (para 20). The judgment does not record that any data were provided.

Liability. The court dismissed the damages claim, finding no exceptional duty to warn in mass payment business (paras 16–18). Of relevance here is only its remark that the bank would have had to execute the transfers even if its internal system had issued a warning (para 18).

The tracing report established by the law company. The €2,975 would not have been recoverable even with liability: the work in this report amounted to a factual review and legal assessment covered by the pre-trial business fee (No. 2300 VV RVG), a separate opinion mandate under § 34 RVG was not shown to be necessary, and recovery was also excluded by the duty to mitigate under § 254 BGB (para 19). EFRI is sceptical of law firms charging separate fees for “tracing reports” as part of recovery work and agrees with the court’s refusal to award those costs in this case.

Access. The court did not decide on the request as filed. It read the claim “on a proper interpretation” as a request (only) for the production of logs, monitoring extracts, internal notes and case records — dropping the primary request for all personal data and treating the “in particular” examples as the whole claim — made “in the hope” of finding grounds for the damages claim. That, it held, is not a purpose of Article 15(1) GDPR. C‑487/21 did not require a different result: it does not entitle a data subject asserting a claim of another kind to all correspondence and internal notes on the controller’s handling of that claim, as this would unreasonably restrict the controller’s defence. The court repeated that the control system would not have had to intervene, and left open whether the bank’s statement that it had not been triggered partly fulfilled the claim (para 20).

The judgment does not refer to Article 12(5) GDPR, C‑307/22 or C‑526/24 Brillen Rottler, and does not disclose whether an access request preceded the action; we have not examined the case file.

A litigation purpose does not bar access

In C‑307/22 FT v DW (26 October 2023), a patient sought a free copy of his dental records to assess claims against his dentist — a litigation purpose comparable to a customer seeking her transaction data to assess claims against her bank. The Court held that access does not depend on reasons (para 38); that recital 63 cannot be read as requiring rejection of a request with another purpose (paras 43–44); and that the right may not be subjected to conditions the legislature has not laid down (para 51). The free first copy is therefore owed even then (para 52). Para 32 records the referring court’s assessment that the request was not abusive.

The EDPB’s Guidelines 01/2022 on the right of access (version 2.1 of 30 May 2024) likewise state that an intention to use the data for further claims against the controller does not itself make a request excessive (para 189); Example 1 addresses evidence-gathering for a dismissal claim. The guidelines are non-binding and predate Brillen Rottler.

Abuse after Brillen Rottler

The abuse objection remains available, but the Berlin court did not apply it. In C‑526/24 Brillen Rottler (19 March 2026), the CJEU held that even a first request may be “excessive” under Article 12(5) GDPR. The concept is narrow, available only exceptionally, subject to high standards, and the controller bears the burden of proof (para 35). Abuse requires an objective element — circumstances showing that, despite formal compliance, the purpose of the rules was not achieved — and a subjective one: the intention to obtain an EU-law advantage by artificially creating the conditions for it (para 36). Para 40 is broader: a request made for a purpose other than becoming aware of processing and verifying its lawfulness. The operative answer requires proof of abusive intent, with artificial creation of a GDPR advantage as an example; public information on a pattern of requests followed by damages claims may be considered when corroborated (paras 43–45).

The facts illustrate one abuse pattern: a newsletter subscription, an access request thirteen days later, then at least €1,000 demanded for the refusal. On resumption, the AG Arnsberg dismissed the access and damages counterclaims on 1 July 2026 (42 C 434/23) — an application to that case, not a general exclusion of requests preparing civil claims.

In EFRI’s view, paras 36, 40 and 45 must be read together: the absence of a privacy motive does not by itself prove abuse. Seeking information about real transactions after an existing loss differs materially from engineering a fresh compensation claim. That is no automatic immunity — all circumstances must be assessed — but the wish to investigate a civil claim cannot replace proof of exceptional abuse.

Personal data, not documents

C‑487/21 (4 May 2023) governs the copy, not the purpose. The copy must faithfully and intelligibly reproduce the personal data; extracts or entire documents are owed where indispensable for the effective exercise of rights. There is no general right to internal files — a sound limit. But the Berlin court applied it only after recasting a request for “all personal data … in particular” certain records into a request for the records themselves, without explaining why that reading justified refusing the underlying personal data. Absent the case file, this is a criticism of the published reasoning, not a conclusive finding of procedural error.

In C‑579/21 Pankki S (22 June 2023), a bank case, the CJEU held that information on consultations of a data subject’s data, including dates and purposes, falls within the right of access, while the identity of individual employees in principle does not, subject to qualifications (paras 69–83). Transaction-level risk scores, alerts, flags and case notes relating to an identifiable customer can likewise be personal data — a consequence of the broad definition, which includes assessments (C‑487/21, paras 23–26), not a holding in Pankki S on fraud monitoring. “The monitoring was not triggered” does not establish that no personal data on the transaction were processed.

The bank’s defence: and the real limits

German law distinguishes information duties from access rights. § 33(1) no. 2(a) BDSG exempts private controllers from the Article 14 information duty where conditions concerning civil claims or crime-prevention processing are met, unless the data subject’s interest prevails. § 34(1) no. 1 BDSG, governing access, refers to § 33(1) no. 1, no. 2(b) and § 33(3) — not to no. 2(a). That exception cannot simply be imported into the access right. Other objections remain possible under § 29(1), second sentence, BDSG, the GDPR itself and special provisions, but the judgment applies none of them.

The genuine limits set out above — Article 15(4), the tipping-off rules in §§ 47 and 11a GwG, trade secrets and C‑203/22 — would have required the court to assess which of the requested data actually fall within them. Some of what the claimant asked for, notably anything revealing a suspicious transaction report, may well have been protected. The judgment does not undertake that assessment; it refuses the request as a whole on the ground of its purpose.

A circular standard

The court held that the bank would have had to execute the transfers even with a warning (para 18), then relied on the same point to deny access to what the system recorded (para 20). Liability and access are separate questions; the right to one’s data does not depend on the success of a later claim.

Austria: the BVwG decision

The BVwG case concerned 42 access complaints the Data Protection Authority (DSB) had upheld against a mobile operator (of 43 joined complaints, one was rejected for lack of a request). A lawyer cooperating with an association that works with litigation funders had sent identical requests, each with an ID document, on behalf of people presented as current or former customers. They asked which data, “including invoice data”, were processed and, “in particular”, whether and how much the client had paid in service fees. The refund claims rest on OGH 4 Ob 62/22d and 4 Ob 59/22p of 18 October 2022 on fitness-studio service-fee clauses and, for this operator, on a final judgment of the Commercial Court of Vienna of 22 October 2025 (50 R 184/25b) holding its fees inadmissible. The lawyer charged €180 irrespective of success; the association offered a no-upfront-fee route for 30% of any recovery. Around 1,000 civil proceedings were pending against the operator after access had been granted to others (Findings; section 3.3.2.3.2).

Eleven non-customers were entitled at least to a negative confirmation; refusing it as “manifestly unfounded” would empty the first limb of Article 15(1), and abuse was not proved (section 3.3.2.2.2).
In the 31 customer cases, the court allowed refusal and reversed the DSB. Applying Brillen Rottler, it found the requests made exclusively to quantify a civil claim, ruled out any data-protection purpose given their wording and the providers’ public offers, likened the template-based, high-volume approach to earlier mass campaigns and found a profit motive. It noted that claimants could use a stepped action (Stufenklage, RS0108687), citing equality of arms and C‑268/21 Norra Stockholm Bygg (section 3.3.2.3.2). Citing commentary, it distinguished non-profit data-protection organisations (section 3.3.2.3.1) — not a categorical exemption for every non-profit request.

Revision was admitted on both questions, including whether Article 12(5) permits refusal where the data subject pursues exclusively non-data-protection motives, given earlier decisions of the Vienna Higher Regional Court (14 R 48/24t; 11 R 86/25k) and the BVwG (W258 2205602-1) (section 3.5).

Our Assessment

On liability. This case note reaches no conclusion on whether the damages claim should have succeeded. Reporting the court’s view on warning duties is not an endorsement of the bank’s conduct or an acceptance that all relevant facts were available to the claimant.

On data access in Berlin. The published reasoning is insufficient. It treats a litigation purpose as a ground for refusal without addressing C‑307/22; it turns a personal-data request into a document request; it invokes the bank’s defence without a concrete legal restriction; and it contains no Article 12(5) assessment meeting the Brillen Rottler standard. Denying liability cannot resolve the independent access claim.

On the BVwG. The court identifies concrete circumstances, but its inference of abuse is open to serious criticism. First, it cites para 36 of Brillen Rottler and addresses both elements; the question is whether it established abusive exercise of the access right rather than merely an exclusive refund motive — the civil claim and the EU-law access right must not be conflated. Second, C‑307/22 accepted a litigation purpose; that must be reconciled with an inference of abuse drawn from that very purpose, even though C‑307/22 did not decide the abuse issue (para 32). Third, Brillen Rottler looks to the data subject’s intention; a representative’s fee model is evidence, not proof of each client’s abuse. Fourth, a national procedural alternative is not a condition of Article 15. Campaigns and commercial incentives may justify scrutiny, but they do not replace proof of exceptional abuse. We have not verified whether VwGH proceedings have been initiated or concluded.

Why this matters for fraud victims. Bank liability in authorised push payment fraud can depend on what the bank knew or should have recognised. That may only be assessable from records the bank alone holds: customer-specific assessments, alerts or processing notes. If the wish to investigate becomes a reason to refuse access, the information imbalance is locked in. Access does not establish liability, but it may be essential to knowing whether a claim exists.

The limits we accept. Victims have no unrestricted right to complete AML files, to disclosure contrary to tipping-off rules, to other people’s data irrespective of their rights, or to a detection system’s full algorithm. Those limits require concrete application of Article 15(4), § 29(1), second sentence, BDSG and §§ 11a and 47 GwG, with mixed data assessed rather than excluded, and (where Article 15(1)(h) applies) the explanation and balancing required by C‑203/22. That data may be used against the bank is not a reason to withhold them.

Redress starts with information, and in payment fraud the information sits with the intermediary. The intermediary is not only the pressure point; it is also the record-keeper.

What victims can do

Ask your own bank. Name the account, the transfers (dates and amounts) and the data you want., for example transaction records, risk assessments, alerts and processing notes on your payments. No reasons are needed; the first copy is generally free, and the bank must answer within one month (extendable by two further months only where necessary, with notice and reasons within the first month).
Ask the receiving payment provider too. You need not be its customer. It may hold your name, account details, payment references, or records of fraud reports and recall requests about your payments — but not the payee’s customer file; records concerning both of you require assessment under Article 15(4) (EDPB Guidelines 01/2022, paras 102–106).
Ask early. The right covers existing personal data; it does not oblige the bank to produce a new forensic analysis or legal assessment.
If refused, incomplete or ignored, you can complain to a data protection authority, for example in your country of residence (Article 77 GDPR), or go to court (Article 79 GDPR); the complaint is an option, not a mandatory step before court.

Status: 22 October 2026. We have no verified information on an appeal against the Charlottenburg judgment or on a revision against the BVwG decision.