GDPR – Right to copy may also include excerpts from documents or even entire documents
GDPR – Right to copy may also include excerpts from documents or even entire documents
[ECJ decision of 4 May 2023 (Case C300/21)]
Within the scope of the GDPR right to information according to Art. 15 Para. 3 Sentence 1, data subjects can receive a copy of processed personal data. However, in a legal dispute in Austria, the Federal Administrative Court remained unclear as to exactly what this right encompasses. The question was whether the envisaged obligation – to provide a “copy” of the personal data – is already fulfilled if the controller transmits the personal data as a table in an aggregated form, or whether this obligation also includes the transmission of extracts from documents or even entire documents as well as extracts from databases in which this data is reproduced.
The ECJ interprets the provision of Art. 15 Para. 1 S. 1 GDPR in such a way that the data subject must be provided with a faithful and understandable reproduction of all his processed personal data. That right implies that a copy of extracts from documents or even entire documents or extracts from databases containing, inter alia, contain his data, if the provision of such a copy is essential to enable the data subject to effectively exercise the rights conferred on him by the GDPR. In doing so, the rights and freedoms of others must be taken into account, i. H. in the event of a conflict, a balance must be struck between a data subject’s right to full access and the rights or freedoms of others. However, this should not lead to the data subject being denied any information.
In addition, the ECJ explained that the term “information” in Art. 15 Para. 3 S.3 GDPR only covers the personal data from which the person responsible for processing according to Art. 15 Para. 3 S. 1 GDPR GMO must provide a copy. This does not include the information specified in Art. 15 (1) (a) to (h) GDPR or even additional information such as data metadata.
In the initial legal dispute, the plaintiff requested information from a credit reporting agency in accordance with Art. 15 GDPR about the processed personal data relating to him. The credit agency then sent the plaintiff an aggregated list of his personal data that was the subject of the processing. Since the plaintiff was of the opinion that the credit agency should have sent him a copy of all documents containing his data, such as e-mails and extracts from databases, he lodged a complaint with the Austrian data protection authority, which was unsuccessful stayed.
The Federal Administrative Court, which subsequently dealt with the matter, then submitted a request for a preliminary ruling to the ECJ on the interpretation of Art. 15 Para. 3 S. 1 GDPR and also asked for clarification as to what the term “information” in Art. 15 Para. 3 p. 3 GDPR.
The decision will raise questions in practice, e.g. when a document or a database as a whole is to be regarded as personal data and when at the same time the rights and freedoms of others conflict. One will also have to deal with the question of how the requirements of Article 12 (1) GDPR can be met at the same time, because according to this, the information to be transmitted in an “intelligible form”.
The APTIQ Global legal and compliance consultants have many years of practical experience in the field of data protection law and are happy to support you with all data protection challenges.