The Court of Justice of the European Union (CJEU) explains the right to a copy under data protection law in accordance with Art. 15 (3) GDPR and clarifies questions regarding the content and scope of this data subject right. The ruling has far-reaching consequences for data controllers (judgment of 4 May 2023, ref.: C-487/21).
Background to the decision
The CJEU’s decision centres on CRIF, a credit reference agency that provides information on the solvency of third parties. In December 2018, the plaintiff in this legal dispute requested information about his personal data from CRIF in accordance with Art. 15 GDPR. In addition to a general list of his data, he also requested copies of documents, including emails and database extracts containing his data, in a “standard technical format”.
CRIF responded by providing the plaintiff with an aggregated list of his personal data. However, the claimant was of the opinion that CRIF should provide him with a copy of all documents containing his data and lodged a complaint with the data protection authority. The data protection authority rejected this complaint on the grounds that CRIF had not violated the plaintiff’s right of access under Art. 15 GDPR.
The Federal Administrative Court in Austria, to which the plaintiff appealed, was then confronted with crucial questions concerning the scope of Art. 15 (3) GDPR. In particular, whether the obligation to provide a “copy” of the personal data is fulfilled if the data is transmitted in aggregated tabular form – or whether this obligation also includes the provision of extracts from documents or even entire documents as well as extracts from databases.
The central question that the court had to clarify was whether Art. 15 (3) GDPR merely regulates the form of the provision of information pursuant to Art. 15 (1) GDPR or whether it establishes an independent right of the data subject to access information about the context in which their data is processed in the form of copies of extracts from documents or databases.
In addition, the court had to clarify whether the term “information” in Art. 15 (3) GDPR also includes additional data such as metadata as well as the information mentioned in Art. 15 (1) GDPR or whether it only refers to the “personal data undergoing processing”.
Current judgements on the GDPR
Read our regular reviews of data protection law rulings to stay up to date!
Questions referred to the CJEU
As a result, the Federal Administrative Court in Austria felt compelled to refer the following questions to the CJEU for a preliminary ruling:
- How is the term “copy” in Art. 15 (3) GDPR to be interpreted?
- Does Art. 15 (3) sentence 1 GDPR contain a general right of the data subject to receive copies of entire documents or database extracts in which their data is processed, or is this right limited to the faithful reproduction of the personal data in accordance with Art. 15 (1) GDPR?
- Under what circumstances may it be necessary to make text passages or entire documents available to the data subject, in particular with regard to the type of data processed and the transparency requirement in 12 (1) GDPR?
- What does the term “information” according to Art. 15 (3) sentence 3 GDPR include, especially if the application is made electronically?
The judgment
Scope of the right to data copies
With regard to the first three questions referred, the judges clearly ruled: The right to a copy of data pursuant to Art. 15 (3) sentence 1 GDPR includes the right to a faithful and intelligible reproduction of all personal data that is undergoing processing. If this is necessary for the effective exercise of rights under the GDPR, it also includes the right to copies of document extracts, entire documents or extracts from databases. This should ensure that the data subject can effectively exercise their rights under the GDPR, such as the right to erasure (Art. 17 GDPR), while also taking into account the rights and freedoms of other individuals in order to resolve any conflicts.
This interpretation by the CJEU is based on the clear wording and objectives of the GDPR, in particular the principle of transparency. The aim is to ensure that data subjects can receive precise, easily accessible and comprehensible information about the processing of their personal data. In cases where contextualisation of the data is necessary to ensure its comprehensibility, copies of document extracts or entire documents may be essential.
According to Art. 15 (4) GDPR, in line with the explanations in Recital 63, the right to obtain a copy pursuant to para. 3 should not adversely affect the rights and freedoms of others. This includes the protection of business secrets, intellectual property and, in particular, copyright.
Consequently, and as the Advocate General at the CJEU has already emphasised in his Opinion, in the event of a conflict between the exercise of the right to full and complete access to personal data on the one hand and the rights or freedoms of other persons on the other, the rights in question must be carefully weighed up. It is advisable to choose modalities for the provision of personal data that protect the rights or freedoms of other persons as far as possible without impairing the exercise of the right of access. However, it is important to note that these considerations must not lead to the data subject being denied any information as a matter of principle.
Interpretation of the term “information”
The CJEU was also clear on the fourth question: The term “information” in Art. 15 (3) GDPR refers exclusively to personal data, a copy of which must be provided by the controller in accordance with Art. 15 (3) sentence 1. This follows from the context of the GDPR and the objectives it pursues. The data subject’s right is aimed at obtaining an intelligible and faithful reproduction of their personal data in order to effectively exercise their rights under the GDPR. The form in which the request is made does not affect this right.
It should also be noted that, in accordance with Art. 12 (3) GDPR, the information listed in Art. 15, including the information referred to in Art. 15 (1) a) – h), shall be transmitted electronically if the data subject submits their request electronically, unless they expressly state that they do not wish this.
Data protection assessment
The CJEU once again sets strict standards in the interpretation of data protection provisions in order to guarantee the high level of protection of the right to informational self-determination. This judgment is a continuation of the decision already made in January 2023 on the disclosure of specific recipients of personal data in the context of the right of access under Art. 15 GDPR, which was given a generous interpretation due to the principle of transparency. In the decision discussed here in the context of Art. 15 (3) GDPR, the CJEU once again emphasises the importance of the transparency requirement. This highlights the court’s consistent approach to protecting the rights of data subjects.
In addition, this judgment stresses the clear obligation of data controllers to take all necessary steps to ensure that the information provided is accurate, transparent, easily accessible and in clear and plain language. This includes the comprehensive disclosure of data, including extracts from documents, databases or entire documents, to ensure that the information processed can be understood in the necessary context. Such transparency promotes understanding and enables data subjects to exercise their data protection rights effectively.
The CJEU’s decision to interpret the right of access broadly is in some ways reminiscent of the principle of access to documents in a legal context. Similar to the disclosure requirements in litigation, where an individual has the right to see all relevant information and evidence to strengthen their legal case, this judgment confirms that data subjects need a comprehensive understanding of all personal data concerning them in order to effectively exercise their data protection rights.
Conclusion
The CJEU’s interpretation of Art. 15 GDPR in relation to the right to obtain a copy of personal data has important implications for data protection and the rights of data subjects. It emphasises the importance of transparency and suggests that data protection issues must be carefully weighed up between the rights of data subjects and the rights and freedoms of others, such as trade secrets or intellectual property. This serves the purpose of ensuring a balance between the right to information and the protection of the interests of third parties.
The CJEU is not so much concerned with the literal meaning, but rather with the objective of the regulation. Consequently, the right to information cannot be divided into two separate claims. Dogmatically, Art. 15 (1) and (3) are not claims in their own right, but a single comprehensive right of access that covers both information about the processing and the context of the processing itself. This will not make things any easier for controllers in future. Every request for a right to access must therefore be interpreted as a comprehensive right in accordance with Art. 15.
In summary, this interpretation shows that the GDPR aims to give data subjects full control over their personal data while ensuring that they can verify the lawfulness of the processing. As one of the most frequently exercised rights of data subjects, the right of access under Art. 15 GDPR is likely to continue to be the subject of discussion at the CJEU and will form part of further decisions.
