ECJ: The Right to ‘a Copy’ under GDPR

Jun 9, 2023 Benn-Ibler Rechtsanwälte

The European Court of Justice (ECJ) has clarified that under the right to information pursuant to Article 15 of the General Data Protection Regulation (GDPR), copies of entire documents may have to be provided.

In the original case, the complainant had asked CRIF, a credit bureau, to provide him with information on his personal data pursuant to Article 15 of the GDPR, as well as copies of documents (i.e., emails and database extracts) containing his data in a ‘commonly used electronic form.’ CRIF provided him a summary of his personal data by way of list, but not copies of the documents.

However, the complainant felt that CRIF should have provided him with a copy of all of those documents containing his data and lodged a complaint with the Data Protection Authority (DPA).

DPA dismissed his complaint as his right to information had not been violated. The Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG) asked the ECJ for an interpretation.

Pursuant to Article 15 (1) of the GDPR, the data subject has the right of access to their personal data processed by the controller. According to Article 15(3) of the GDPR, the controller shall provide a copy of the personal data which are the subject of the processing.

According to the ECJ, Article 15(3) merely lays down the modalities for fulfilling the right of access and does not contain an independent right to be provided with copies.

From the principle of transparency it follows that the copy to be provided must reproduce the personal data ‘completely and faithfully.’ This might also require the controller to provide copies of extracts from documents or even entire documents that contain personal data, for example. This is particularly necessary if contextualisation of the processed data is required in order to ensure their comprehensibility. Even if personal data are generated from other data or if information about the data subject emerges from a missing piece of information, the context of the processing is essential for transparent disclosure. If this information leads to a conflict with the rights of other individuals, the rights in question must be weighed against each other.

ECJ C-487/21 (04.05.2023)