Data Portability
requires more than
just a PDF.
Data Portability
requires more than
just a PDF.
of
Is it sufficient to send a customer their data as a PDF? For a standard data access request, the answer is usually yes. However, according to the Higher Regional Court of Stuttgart, anyone exercising their right to data portability can demand significantly more—namely, data that software can process directly without any further steps.
62 pages of game history as an image file
From August 9, 2022, to January 2, 2023, a player participated via the German-language website of a gambling provider based in Malta. He primarily placed sports bets and, to a lesser extent, played virtual slot games. The provider held a Maltese license. In Germany, it had received a license for sports betting on November 2, 2020, and a license for virtual slot games on October 13, 2022.
In a letter from his attorney dated February 1, 2023, the player demanded payment of 15,210.39 euros. At the same time, he requested information about his deposit and gaming history. The provider subsequently sent several PDF files, including a statement from the player’s account. This statement comprised 62 pages, each with six columns and over 30 rows. However, the document was merely a scan of a paper printout. Text could neither be highlighted nor copied, and the PDF reader’s search function did not work.
The player then filed a staged lawsuit. This refers to a lawsuit in which information is first requested, followed by payment of an amount yet to be determined. In the first stage, he requested the complete payment and gaming history of all gaming accounts in machine-readable form.
The parties’ arguments
The Stuttgart Regional Court dismissed the lawsuit. It held that a PDF is a common electronic format. Anyone wishing to edit the data can convert it using software or print it out and scan it back in.
In his appeal, the player argued that even text recognition does not allow for a structured analysis. In any case, he claimed that his right to a machine-readable format stems from the law on data portability. The provider argued that it had already provided the information. Data portability was intended to facilitate a switch to another provider, not to prepare a lawsuit for payment. Furthermore, the player had not provided the gaming history; rather, the provider had generated it itself.
The Stuttgart Higher Regional Court orders the provider to disclose the data in a machine-readable format
The Stuttgart Higher Regional Court granted the appeal in its partial judgment of July 31, 2026—Case No. 5 U 271/24 —with regard to the scope of the information to be provided. The provider must disclose the complete payment and gaming history of all gaming accounts in a machine-readable format. The court has not yet ruled on the payment because the player can only quantify his claim after receiving the information.
Why is a PDF sufficient for the right to information but not for data transfer?
The ruling is based on the distinction between two data subject rights under the General Data Protection Regulation. The court denied that the general right to access information includes a claim to machine-readable data. In the context of providing information, the court emphasized human readability and ease of access. In this specific case, the PDF provided was still sufficient for this purpose. The court left open the question of whether a different standard would apply if the original data were machine-readable and a company deliberately provided the information in a form that is difficult to use.
The situation is different with regard to the right to data portability. This right allows the data subject to receive their data in a structured, commonly used, and machine-readable format. The court interprets it as a modified right of access with three requirements. The processing must be based on consent or a contract, be carried out by automated means, and concern data that the data subject has provided themselves. The applicant is not required to provide a justification. The fact that someone exercises their data protection rights to enforce civil claims is, in principle, acceptable.
The court assumed the player’s consent because it was a prerequisite for participating in the games. It also required automated processing by the provider.
What data did the customer provide?
For companies, this is the most important practical question raised by the decision. In the court’s view, deposits, withdrawals, and wagers are among the data provided. The player enters the amounts into an input form themselves, thereby triggering the transactions. Data generated only through the company’s analysis—such as credit scores or profiling data—is not included, however.
The court takes a remarkably broad view of the outcome of a bet or slot machine game. While this outcome depends on external events or the game’s algorithm, it is inherent in the game itself and must be disclosed to the player in any case. The wager and the result therefore constitute a single data set. The court draws on scholarly opinions that classify data such as distances tracked by a fitness tracker, online banking transaction data, or e-commerce order data in the same way. At the same time, it notes dissenting opinions.
When is a format machine-readable?
In the court’s view, a PDF that is merely a digital reproduction of a paper printout is not sufficient. For the definition of the term, the court refers to Directive (EU) 2019/1024. According to that directive, a machine-readable format is one from which software can easily identify, recognize, and extract specific data along with its internal structure. Mere text recognition is not sufficient for this purpose. Otherwise, the criterion would be superfluous, because with today’s technology, virtually any format can be captured by a machine in some way.
Although the table is structured for a human, it is not readily structured for a machine.
The court tested this using the specific document. Even after text recognition, the table could not be cleanly transferred into a spreadsheet. The “Description” column contained several words separated by spaces, which would be split across different fields during conversion. In addition, the characters are slightly pixelated, making recognition prone to errors. As examples of machine-readable formats, the court cites XML, JSON, and comma-separated tables with headers in CSV format. For the player, it makes a significant difference whether he has to calculate 62 pages by hand or can analyze them using a spreadsheet program.
What does this mean for businesses?
The decision concerns a gambling provider, but its reasoning is general in nature. It can be applied to many business models that involve customer accounts, such as online retail, payment services, or platforms. For corporate data protection law, this means that data portability must be assessed independently in response to requests from data subjects. It should be noted that this is a non-final individual decision by a Higher Regional Court.
The ruling clarifies when companies may reject requests. We have previously reported on the threshold for abusive GDPR requests as defined by the ECJ. The Stuttgart Higher Regional Court now highlights the other side of the issue. Anyone who receives a legitimate request must respond not only within the prescribed time limit but also in the correct format.
Conclusion
The Stuttgart Higher Regional Court takes a clear stance on the issue of file format. A party obligated to ensure data portability does not fulfill this obligation by providing an image file disguised as a PDF. A format that can only be used with additional software and manual effort fails to serve the purpose of portability.
The scope of the data provided is less clear-cut. If the outcome of a bet is already considered to have been provided by the customer, there is hardly any transaction data left that would not be recorded. The legal literature is divided on this point, as the court itself acknowledges. The court also provides only a brief justification for the assumption that consent is implied solely from participation in the games. However, this is unlikely to have much bearing on the outcome, since the law on data portability also covers processing carried out on a contractual basis.
According to the court’s understanding, data portability is intended to facilitate switching providers. In this case, it serves to prepare a lawsuit for payment, which the court expressly accepts.
We’d be happy to
advise you on
Data protection law!
