The claimant, an insolvency administrator appointed to manage the assets of J. UG, requests tax-related information on the insolvency debtor in order to examine claims arising from the right to contest the debtor's transactions by virtue of insolvency (hereinafter insolvency avoidance claims, Insolvenzanfechtungsansprüche) from the competent tax office.

In June 2015, the claimant, invoking the Freedom of Information Act of the Federal State of North Rhine-Westphalia (IFG NRW, Informationsfreiheitsgesetz Nordrhein-Westfalen) requested access to information concerning the threat of enforcement measures by the tax office regarding the establishment of tax arrears, and the payments made as a consequence by the insolvency debtor. The tax office rejected the request, stating that the insolvency debtor had not released the tax office from its obligation to preserve tax secrecy.

The action filed against this was essentially successful before the Administrative Court (Verwaltungsgericht). By judgment of 14 September 2017, the Higher Administrative Court (Oberverwaltungsgericht) dismissed the appeal on points of fact and law by the defendant Federal State of North Rhine-Westphalia. 

The defendant's appeal on points of law met with success.

11 The defendant's admissible appeal on points of law is well-founded. The Higher Administrative Court’s judgment breaches the law that is subject to an appeal on points of law (section 137 (1) no. 1 of the Code of Administrative Court Procedure (VwGO, Verwaltungsgerichtsordnung)) and does not prove to be correct for other reasons either (section 144 (4) VwGO), which is why the action is to be dismissed. The Higher Administrative Court's judgment breaches section 32e, section 32c (1) no. 2 of the Fiscal Code (AO, Abgabenordnung) which entered into force during the appeal proceedings on points of law, and which the Court of Appeal would have to take as a basis were it to decide now.

12 1. Access to information of the federal state's revenue authorities is regulated in section 4 (1) of the Act on the Freedom of Access to Information for the Federal State of North Rhine-Westphalia (Gesetz über die Freiheit des Zugangs zu Informationen für das Land Nordrhein-Westfalen) of 27 November 2001 (Law and Ordinance Gazette of North Rhine-Westphalia (GV. NRW, Gesetz- und Verordnungsblatt für das Land Nordrhein-Westfalen), p. 806), which gives every natural person the right of access to official information available at the federal state's authorities and other bodies, subject to the provisions of this Act. The Freedom of Information Act of the Federal State of North Rhine-Westphalia does not provide for any restrictions or exclusion rules for the revenue authorities.

13 The question discussed in the administrative procedure and in the lower instances, whether or not tax secrecy as provided for in section 30 AO stands against the insolvency administrator's right of access, was answered in the negative by the 7th Senate of the Federal Administrative Court (BVerwG, Bundesverwaltungsgericht) in its judgments of 26 April 2018 - 7 C 3.16, 7 C 4.16, 7 C 5.16 and 7 C 6.16 - (...). The insolvency administrator's right to manage the insolvency estate and the right of disposal (Verwaltungs- und Verfügungsbefugnis) as provided for in section 80 (1) of the Insolvency Code (InsO, Insolvenzordnung) covers information that serves to examine insolvency claims. The insolvency administrator is entitled to use all secrets of the insolvency debtor that are of relevance for the insolvency avoidance (Insolvenzanfechtung). It does not constitute a violation of the tax secrecy if such information is made available to the insolvency administrator; insofar, the rules applicable to the taxable insolvency debtor itself also apply to the insolvency administrator. Therefore, under the legal situation applicable at the time the decisions by the lower instances were taken, the tax offices in North Rhine-Westphalia were in principle obligated to provide access to information to the insolvency administrator pursuant to section 4 (1) IFG NRW.

14 2. However, section 32e, section 32c (1) no. 2 AO now preclude the right of access to information. Both provisions were inserted through article 17 no. 11 of the Act of 17 July 2017 (Federal Law Gazette (BGBl., Bundesgesetzblatt) I p. 2541), and, pursuant to article 31 (4) of the Act, entered into force on 25 May 2018. Pursuant to section 32e AO, articles 12 to 15 of the General Data Protection Regulation (GDPR) in conjunction with sections 32a to 32d AO are applicable accordingly if the data subject or a third party has a right of access to information against the revenue authority under the federal and federal state acts on freedom of information.

15 a) Insofar as claims - as in the present case - against authorities of the federal states are concerned, the federal legislature's legislative power to enact section 32e, section 32c (1) no. 2 AO follows from article 108 (5) second sentence of the Basic Law (GG, Grundgesetz). According to this provision, the procedure to be followed by the federal states' revenue authorities or, as provided by subsection 4 second sentence of the article, by municipalities (associations of municipalities) may be prescribed by a federal law requiring the consent of the Bundesrat. This includes the decision to regulate or to refrain from regulating the right of access to procedural files, even after the conclusion of the relevant procedure, provided that a transition to court proceedings has not taken place (...). It is true that the rights of access to information under the federal and federal state acts on freedom of information which are independent of specific procedures and are modified by section 32e AO are not to be classified as rules relating to administrative procedure (see BVerwG, decision of 15 October 2007 - 7 B 9.07 - (...) para. 9, (...)). However, the right to enact regulations governing access to procedural files, which is covered by federal legislative power for the administrative procedures of the federal states' revenue authorities, would inappropriately remain incomplete if it did not at the same time cover the right to enact regulations governing claims for access to information from the revenue authorities' procedural files which are based on general rights of access to information under the laws of the federal states. Otherwise, the federal legislature would not be able to enact conclusive regulations that are binding also in relation to the federal states' legislatures regarding a concept of accessibility or confidentiality of procedural information that the federal legislature considers to be reasonable or even necessary. Insofar, the uniformity of the revenue administration intended to be brought about through article 108 (5) second sentence GG would not be achieved.

16 b) Contrary to the defendant's view, section 32e first sentence AO cannot be interpreted as constituting a reference to a legal basis. It would lead to the corresponding application as ordered therein of articles 12 to 15 of GDPR in conjunction with sections 32a to 32d AO to rights to information by third parties always resulting in the exclusion of a claim and therefore coming to nothing due to the absence of data subject status.

17 Section 32e AO does not replace the rights under the federal and federal state acts on freedom of information, but merely modifies them. This already results from the wording of the provision which requires that such a right exists and merely regulates the limitations of the right with regard to its legal consequences. This means that the right of access to information continues to result from section 4 (1) IFG NRW. The acts on freedom of information that apply in the relevant case regulate the conditions of the claim as well as the restrictions, if any, which may go beyond those to which reference is made in section 32e first sentence AO. The provisions of the Fiscal Code regulating the tax procedures are applicable not instead of, but in addition to those of the acts on freedom of information and of the General Data Protection Regulation (BVerwG, decision of 28 October 2019 - 10 B 21.19 - (...) para. 7). By way of a reference to the legal consequences of another legal provision, section 32e AO extends the restrictions provided for in sections 32a to 32d AO of the right of access under article 15 GDPR - both for the data subject and for third parties - to the right of access resulting from the federal and federal state acts on freedom of information (BVerwG, judgment of 16 September 2020 - 6 C 10.19 - (...) para. 31).

18 The defendant and the Representative of the Interests of the Federation at the Federal Administrative Court (Vertreter des Bundesinteresses beim Bundesverwaltungsgericht) therefore cannot successfully argue that the claimant's request for access to information does not even meet the personal requirements of article 15 GDPR, and that the right is therefore excluded. It is correct that the claimant is not the data subject within the meaning of article 15 GDPR, and can therefore not in his own name as the insolvency administrator assert the directly affected insolvency debtor's right of access under data protection law pursuant to article 15 (1) GDPR. This is because data subject status under data protection law is a highly personal right of the debtor that is not part of the insolvency estate and therefore is not covered by the transfer of the right to manage the insolvency estate and the right of disposal to the insolvency administrator in accordance with section 80 (1) InsO (BVerwG, judgment of 16 September 2020 - 6 C 10.19 - (...) para. 16 et seqq. and decision of 4 July 2019 - 7 C 31.17 - (...) para. 13). However, the right of access to information under section 4 (1) IFG NRW as modified by section 32e AO does not require data subject status. The claimant is entitled under section 4 (1) IFG NRW without having data subject status within the meaning of article 15 (1) GDPR. This is because section 32e AO is linked merely to an existing right of access to information, but not to the constituent elements of the right of access under data protection law pursuant to article 15 GDPR.

19 c) Pursuant to section 32c (1) no. 2 AO, which is applicable mutatis mutandis via section 32e AO, a data subject does not have a right of access under article 15 GDPR in relation to a revenue authority if the granting of access to information would impair the legal entity of the revenue authority in the establishment, exercise or defence of civil law claims or in the defence against such civil law claims brought against it within the meaning of article 23 (1) (j) GDPR; the revenue authorities' obligations to provide access to information under civil law remain unaffected.

20 Article 23 GDPR includes a catalogue of opening clauses which give the federal and federal state legislatures the power, for the reasons listed there, to restrict, inter alia, the rights of data subjects and the obligations of data controllers under article 12 to 22 GDPR. Section 32c AO comprises, based on article 23 (1) GDPR, area-specific restrictions of the data subject's right of access under article 15 GDPR. Section 32c (1) no. 2 AO makes reference to the opening clause in article 23 (1) (j) GDPR. According to this provision, the rights of data subjects under the General Data Protection Regulation may be restricted in order to safeguard the enforcement of civil law claims. The explanatory memorandum (Bundestag printed paper (BT-Drs., Bundestagsdrucksache) 18/12611 p. 88) additionally makes reference to article 23 (1) (e) GDPR which allows restrictions to protect other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters.

21 Section 32c (1) no. 2 AO aims to correct the "insolvency-administrator-friendly" jurisprudence of the administrative courts regarding requests for access to information under the federal and federal state acts on freedom of information, as seen also in the decisions given by the lower instances in the present proceedings. According to that jurisprudence, the administrative power and right of disposal of the insolvency administrator under section 80 (1) InsO also extend to information covered by tax secrecy, which is intended to be used for the examination of insolvency avoidance claims in accordance with section 129 et seqq. InsO against the revenue authority. As a consequence of this jurisprudence, insolvency administrators were able to demand access to tax data relating to the insolvency debtor from the revenue authorities; only as a result, they were generally able to examine insolvency avoidance claims against the revenue authority. With respect to other creditors of the insolvency debtor, the insolvency administrator is restricted to rights of access under civil law instead, which section 32c (1) no. 2 AO expressly leaves unaffected. However, the rights of access under civil law depend, in accordance with the established jurisprudence of the Federal Court of Justice (BGH, Bundesgerichtshof), on the fact that an insolvency avoidance claim is established on its merits and that the case only involves the further determination of the nature and extent of the claim (see BGH, judgments of 13 August 2009 - IX ZR 58/06 (...) para. 7 with further references and of 14 February 2019 - IX ZR 149/16 - Rulings of the Federal Court of Justice in Civil Matters (BGHZ, Entscheidungen des Bundesgerichtshofs in Zivilsachen) 221, 100 para. 29). As long as an obligation for restitution has not been established, the insolvency administrator therefore has to rely on the insolvency debtor to provide any required information. The insolvency administrator can thus request access to information from other creditors only at a much later stage of the procedure; section 32c (1) no. 2 AO is intended to prevent the revenue authorities being in a weaker position as a result of this (BVerwG, decision of 4 July 2019 - 7 C 31.17 - (...) para. 19 with further references).

22 d) The restriction of rights pursuant to section 32e in conjunction with section 32c (1) no. 2 AO has a sufficient basis in EU law in article 23 GDPR. It is correct that EU law does not result in an obligation to interpret national norms in conformity with EU law even outside its scope of application. However, in the present case this obligation follows from national law. The legislature's intention to ensure application of uniform regulations in tax proceedings, irrespective of the data subject's legal form (see section 2a (3) and (5) AO; BT-Drs. 18/12611 p. 76), results in an obligation to apply a uniform interpretation in conformity with EU law. There are no indications that the objective of the regulation, which was the creation of uniform procedural rules for all data subjects, was to be limited to taxes determined by EU law. A split interpretation of the new provisions in the Fiscal Code for situations that are subject to EU law, on the one hand, and situations that are not subject thereto, on the other, does not come into consideration (BVerwG, decision of 4 July 2019 - 7 C 31.17 - (...) para. 14 et seqq. with reference to BT-Drs. 18/12611 p. 76). In cases where the Fiscal Code provides for a mutatis mutandis application of the General Data Protection Regulation with regard to the extension of the provision to legal persons pursuant to section 2a (5) no. 2 AO and with regard to the rights of access to information pursuant to section 32e first sentence AO, the legal consequence intended by the legislature is the equal treatment of the relevant cases with those where the General Data Protection Regulation is directly applicable. Being aware that this resulted in an extension of the General Data Protection Regulation's scope of application to purely domestic cases, the legislature did not make any corresponding differentiations.

23 aa) In view of the decision on it's lack of jurisdiction by the Court of Justice of the European Union (CJEU, hereinafter Court of Justice) in its judgment of 10 December 2020 - C-620/19 [ECLI:EU:C:2020:1011], the opening clause in article 23 (1) (j) GDPR must be interpreted by the Senate itself.

24 (1) article 23 (1) (j) GDPR does not preclude a national rule that provides for restrictions of the rights of data subjects and of obligations to provide information in the interests of the enforcement of civil law claims of public authorities. The wording as well as the spirit and purpose of article 23 (1) (j) GDPR indicate that restrictions in the interests of authorities are possible on the basis of this provision. The genesis and the general scheme do not preclude this.

25 The wording of article 23 (1) (j) GDPR is aimed at the "enforcement of civil law claims", and thus at the protection of the parties in civil proceedings, without distinguishing between private legal entities and legal persons under public law. A legal person under public law can also be a party in civil law proceedings. Nothing in the wording of article 23 (1) GDPR or in recital 73, which is relevant here, excludes from the scope of application of that provision civil law actions in which public authorities take part, as either the claimant or as the defendant. Even if civil law claims are mostly brought between private persons, in pursuit of a private interest, no reasonable ground on the basis of which the EU legislature would have wished to treat differently civil law proceedings in which the public authorities are parties is apparent (see also, opinion of Advocate General Bobek of 3 September 2020 - C-620/19 [ECLI:EU:C:2020:649], Nordrhein-Westfalen - para. 103 et seq.).

26 The objective of article 23 (1) (j) GDPR also indicates that it is an opening clause also for the benefit of authorities. The opening clause safeguards the enforcement of civil law claims under national law, thus taking into account the special significance of the principles of national contract and procedural law (...). It is not apparent why these procedural principles should not be worthy of protection if authorities are involved. According to the statements of the Advocate General, the aim of the rule laid down in letter (j) is to permit the legislature to decide that, in civil proceedings, the specific regulations on obligations to provide access to information and to disclose information (Auskunfts- und Offenlegungspflichten) should prevail, in case of conflict, over the general rules stemming from data protection. Any special regulations on obligations to provide access to information and to disclose information that may exist under national law should remain unaffected by the rules under data protection law. This must apply irrespective of whether the parties are subjects of private or public law, and regardless of the private or public interest on which the action is based (opinion of Advocate General Bobek of 3 September 2020 - C-620/19, Nordrhein-Westfalen - para. 105). The Senate follows this view.

27 The genesis of the provision does not lead to a different interpretation. The opening clause corresponds for the most part to the catalogue in article 13 (1) of the Data Protection Directive 95/46/EC which was replaced by the General Data Protection Regulation. However, the option of restricting the rights of data subjects and the obligations to provide information for the enforcement of civil law claims within the meaning of article 23 (1) (j) GDPR was not included in the catalogue in article 13 (1) of Directive 95/46/EC, nor in the initial Commission draft for the General Data Protection Regulation. Rather, the introduction of the opening clause is based on a proposal by the Council which, however, does not include any indications that the EU legislature intended to limit the scope of application of this amendment to enforcement claims brought by private parties (see opinion of Advocate General Bobek of 3 September 2020 - C-620/19, Nordrhein-Westfalen - para. 109). Even if the introduction of letter (j) may have been prompted by the judgment in Promusicae, which concerned the disclosure of traffic data by an internet access provider to private parties for the purpose of the civil law pursuit of copyright infringements (CJEU, judgment of 29 January 2008 - C-275/06 [ECLI:EU:C:2008:54], Promusicae -), it is not apparent why the EU legislature should have intended to limit the amendment to the specific facts of that dispute (see opinion of Advocate General Bobek of 3 September 2020 - C-620/19, Nordrhein-Westfalen - para. 111).

28 (2) Any defence against civil law claims is covered by the opening clause in article 23 (1) (j) GDPR. Unlike article 23 (1) (j) GDPR, which only provides for restrictions for the enforcement of civil law claims, section 32c (1) no. 2 AO mentions the defence against civil law claims in addition to the "establishment, exercise or defence of civil law claims". According to conventional understanding, the term "enforcement" as used in the opening clause in article 23 (1) (j) GDPR refers to the sphere of the holder of a claim and is primarily used as a synonym for the execution or enforcement of a claim which has already been established on the merits. The defence against civil law claims therefore cannot simply be subsumed under the term "enforcement". However, a wider interpretation of this element is required. A narrow interpretation would upset the procedural balance between the parties to the judicial proceedings by favouring only the claimant. In order to avoid interference with the parties' status in civil law proceedings, this must apply to the establishment of, as well as to the defence against civil law claims. Reasons why the establishment of claims in civil law proceedings should benefit from special protection, whilst this protection should not be afforded to the defence against civil law claims, are not apparent. The special national regulations on obligations to provide access to information and to disclose information serving to take evidence in civil law proceedings can - depending on the distribution of the burden of proof - inure to the benefit of the claimant or of the defendant. The safeguarding of the parties' status in civil law proceedings under national law intended by article 23 (1) (j) GDPR suggests that the "enforcement" of civil law claims as a generic term is to cover any exercising of rights which is intended to safeguard a claim in an active (establishment) as well as in a passive (defence) context. Section 32c (1) no. 2 AO therefore is covered by article 23 (1) (j) GDPR insofar as it excludes the right of access for the purpose of defending against civil law claims. The term "enforcement" comprises the term "defence" against the claim brought by the claimant. This conclusion is not called into question by the fact that other provisions of the General Data Protection Regulation, such as article 18 (1) and (2) and article 21 (1), use the phrase "establishment, exercise or defence" of a right before the courts. Said provisions do not at the same time use the term "enforcement"; thus, they do not lend themselves to drawing a meaningful comparison (see opinion of Advocate General Bobek of 3 September 2020 - C-620/19, Nordrhein-Westfalen - para. 118 et seq.).

29 (3) Furthermore, section 32c (1) no. 2 AO is to be understood in line with its spirit and purpose, to the effect that the wording "established" also encompasses "yet to be established" or "possible" claims. This interpretation is covered by the opening clause in article 23 (1) (j) GDPR. If letter (j) is aimed at the protection of the parties' status in civil law proceedings under the national legal regimes, it is unreasonable to assume that this applies only after the point in time when one of the parties has already obtained sufficient information, and is thus in a position where it is able to establish its claim. If, however, the right of access were to be excluded only after establishment of the insolvency avoidance claim, the rule would to a great extent be ineffective, as the insolvency administrator would have already acquired the necessary data (BVerwG, decision of 4 July 2019 - 7 C 31.17 - (...) para. 21). It is quite conceivable that special national legal provisions on the status in civil law proceedings may exist for the early stages of the proceedings, where the objective initially is to determine the requirements that constitute the basis for a claim. Also, it would be incomprehensible why the EU legislature would permit Member States to maintain specific regulations on obligations to provide access to information and to disclose information only in certain types or stages of civil law proceedings and not in others. If reasons relating to the protection of the integrity and fairness of civil law proceedings allow Member States to introduce restrictions to the rights of data subjects and obligations of data controllers, those rules should apply, in principle, at any stage of the proceedings. A restriction of the right of access only during the last stage of the proceedings would be meaningless, as the claimant would have been able to acquire the information sought by then (opinion of Advocate General Bobek of 3 September 2020 - C-620/19, Nordrhein-Westfalen - para. 121 to 123).

30 bb) Furthermore, section 32c (1) no. 2 AO can also be based on article 23 (1) (e) GDPR. The Senate now deciding on the matter no longer maintains the concerns expressed in the decision to request a preliminary ruling that the requested tax information was of interest not for the tax claims under substantive law, but rather mainly for the payment flows that are relevant under insolvency law as potentially contestable transactions within the meaning of section 129 (1) InsO, leading to the conclusion that the insolvency administrator's claim directed against the revenue authority was not to be classified as a claim "arising from the tax relationship" (BVerwG, decision of 4 July 2019 - 7 C 31.17 - (...) para. 24 with further references). The term "taxation matters" within the meaning of article 23 (1) (e) GDPR does not require a limiting interpretation to the effect that only the tax-law relationship was covered. Letter (e) is not a restriction of the right of access to be interpreted narrowly, but merely an explanation of a legitimate objective which, by its nature alone, is open in its wording.

31 Article 23 (1) (e) GDPR governs the protection of other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security. Provided the interest pursued benefits the generality and is not at odds with any principle of EU law, that interest falls within the scope of letter (e) (see opinion of Advocate General Bobek of 3 September 2020 - C-620/19, Nordrhein-Westfalen - para. 130 et seqq.)

32 Section 32c (1) no. 2 AO aims to ensure uniform and lawful taxation and to safeguard tax revenue. In order to achieve these objectives, the revenue authorities are intended to be placed in neither a better nor worse position than other debtors or creditors (BT-Drs. 18/12611 p. 88). There can be no doubt that the objectives of ensuring uniform, lawful taxation and the safeguarding of tax revenue constitute important objectives of general public interest. They are also recognised as legitimate objectives in the EU legal system (see opinion of Advocate General Bobek of 3 September 2020 - C-620/19, Nordrhein-Westfalen - para. 133). It is correct that the legal basis of the tax claims is not affected by the insolvency avoidance, and the claim for restitution of payments that are subject to avoidance under insolvency law does not directly result from the tax relationship. However, important objectives of general public interest relating to budgetary and taxation matters may be impaired if the revenue authorities are disadvantaged in the context of insolvency avoidance. Article 23 (1) (e) GDPR cannot be interpreted to mean that financial interests relating to budgetary or taxation matters are impaired only if the tax claim is affected with regard to its legal basis or its legal existence. Rather, the provision is aimed in a wider sense at the protection of "other important objectives of general public interest of the Union or of a Member State", stating as examples important economic or financial interests, such as budgetary and taxation matters. Financial interests to be classified as taxation matters may also be affected in the area of insolvency law, for example within the framework of insolvency avoidance.

33 A successful insolvency avoidance and the more difficult enforcement of tax claims in insolvency proceedings that necessarily follows from it has a direct effect on the safeguarding of uniform and lawful taxation and of tax revenue. A successful insolvency avoidance has the consequence that the creditor has to include the - initially satisfied, now reopened - claim, with the insolvency table. The creditor is then satisfied in accordance with the insolvency dividend, which usually covers only a fraction of the included claims, and may even be zero. If the insolvency administrator, based on a right of access to information, obtained information from the tax offices which he or she could not obtain from other creditors, insolvency avoidance against the revenue authorities would be made easier for him or her. Insofar, the revenue authorities would be in a worse position than private creditors. Due to the facilitated insolvency avoidance because of corresponding rights of access to information, the revenue authorities would be at risk to have to reimburse higher amounts to the insolvency estate than other creditors. Here, it is not the insolvency avoidance as such that is problematic, but rather the facilitation of the procedural enforcement of the restitution claim against public bodies (...).

34 3. The judgments are therefore based on a violation of sections 32e and 32c (1) no. 2 AO. The Senate may decide on the matter itself (see section 144 (3) first sentence no. 1 VwGO). The right of access to information under section 4 (1) IFG NRW is excluded pursuant to section 32e, section 32c (1) no. 2 AO. The conditions of section 32c (1) no. 2 AO are met in the present case. The claimant requests the information for the purpose of establishing insolvency avoidance claims, i.e. civil law claims within the meaning of section 32c (1) no. 2 AO. The information sought is aimed at those elements of the insolvency avoidance that form the basis of the claim, and would enable the claimant to establish insolvency avoidance claims against the revenue authority. Therefore, the granting of access to information may impair the legal entity of the revenue authority with regard to the defence against future insolvency avoidance claims.