By its judgment on 4 May 2023 (case Österreichische Datenschutzbehörde and CRIF, C-487/21), the European Court of Justice provides clarification on the content and scope of the data subject’s right of access to his or her personal data undergoing processing.

In that regard, it considers that the right to obtain from the controller a ‘copy’ of the personal data undergoing processing pursuant to the first sentence of Article 15(3) of the GDPR means that the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by the GDPR, bearing in mind that account must be taken, in that regard, of the rights and freedoms of others.

Furthermore, the Court states that the concept of ‘information’ referred to in the third sentence of Article 15(3) of the GDPR relates exclusively to personal data of which the controller must provide a copy pursuant to the first sentence of that paragraph. Findings of the Court In the first place, the Court gives a literal, systematic and teleological interpretation of the first sentence of Article 15(3) of the GDPR, which provides for the right of the data subject to obtain a copy of his or her personal data undergoing processing.

As regards the wording of the first sentence of Article 15(3) of the GDPR, the Court notes that, although that provision does not contain a definition of the term ‘copy’, account must be taken of the usual meaning of that term, which refers to the faithful reproduction or transcription of an original, with the result that a purely general description of the data undergoing processing or a reference to categories of personal data does not correspond to that definition. Furthermore, it is apparent from the wording of that provision that the disclosure obligation relates to the personal data undergoing the processing in question. After conducting a literal analysis of that provision, the Court holds that it confers on the data subject the right to obtain a faithful reproduction of his or her personal data, understood in a broad sense, that are subject to operations that can be classified as processing carried out by the controller.

Regarding the context of which the first sentence of Article 15(3) of the GDPR forms part, the Court notes that Article 15 of the GDPR defines, in paragraph 1 thereof, the subject matter and scope of the data subject’s right of access. Article 15(3) of the GDPR sets out the practical arrangements for the fulfilment of the controller’s obligation, specifying, inter alia, in its first sentence, the form in which that controller must provide the personal data undergoing processing, namely in the form of a ‘copy’. As a result, the first sentence of Article 15(3) of the GDPR cannot be interpreted as establishing a separate right from that provided for in Article 15(1) of the GDPR.

Moreover, the Court notes that the term ‘copy’ does not relate to a document as such, but to the personal data which it contains and which must be complete. The copy must therefore contain all the personal data undergoing processing. With regard to the objectives pursued by Article 15 of the GDPR, the Court notes that the right of access provided for in that article must enable the data subject to ensure that the personal data relating to him or her are correct and that they are processed in a lawful manner.

In addition, according to the Court, it is apparent from the GDPR  that the controller is obliged to take appropriate measures to provide the data subject with all the information referred to, in a concise, transparent, intelligible and easily accessible form, using plain and clear language, and that the information must be provided in writing or by other means, including, where appropriate, by electronic means, unless the data subject requests that it be provided orally. It follows that the copy of the personal data undergoing processing, which the controller must provide, must have all the characteristics necessary for the data subject to exercise his or her rights under that regulation effectively and must, consequently, reproduce those data fully and faithfully.

Accordingly, in order to ensure that the information thus provided is easy to understand, the reproduction of extracts from documents or even entire documents or extracts from databases which contain, inter alia, the personal data undergoing processing may prove essential. In particular, where personal data are generated from other data or where such data result from empty fields, that is to say where there is an absence of information which provides information about the data subject, the context in which the data are processed is an essential element in enabling the data subject to have transparent access and an intelligible presentation of those data.

In the event of conflict between, on the one hand, exercising the right of full and complete access to personal data and, on the other hand, the rights or freedoms of others, the Court takes the view that a balance will have to be struck between the rights and freedoms in question. Wherever possible, means of communicating personal data that do not infringe the rights or freedoms of others should be chosen, bearing in mind that the result of those considerations should not be a refusal to provide all information to the data subject.

In the second place, the Court examines what is covered by the concept of ‘information’ referred to in the third sentence of Article 15(3) of the GDPR. Although that provision does not specify what is to be understood by the term ‘information’, it follows from its context that the ‘information’ to which it refers necessarily corresponds to the personal data of which the controller must provide a copy in accordance with the first sentence of that paragraph. (source: curia.europa.eu/photo: freepik.com)

Τhis article is for information purposes only. For ad hoc advice on any GDPR issue, contact us at info@dplawcyprus.com & +35722272360