On 4th May, the First Chamber of the CJEU passed a judgement regarding case C-487/21 (Österreichische Datenschutzbehörde and CRIF GmbH) on the protection of personal data, specifically, the right of access of the data subject to their data which are the object of processing, as provided for in article 15 of the General Data Protection Regulation (hereinafter, “GDPR”).
The Court seeks to define the scope of article 15 of the GDPR, paying particular attention to the third section thereof, which refers to the right of the data subject to receive a copy of the processed data.
This judgement deals with a case in which a business advice agency, upon the petition of the data subject to access their processed personal data, sent a summarised list containing basic information in this regard. The data subject considered that the list which was facilitated was insufficient, argued that he should have been handed over the totality of the information which the company possessed on him, and thus decided to file a claim before the Austrian Data Protection Authority, which was dismissed.
The individual then filed a claim before the Austrian Federal Administrative Court (Bundesverwaltungsgericht), which presented a preliminary ruling to the CJEU regarding the scope of article 15 of the GDPR, especially regarding the aspects regarding the concept of “information” on the data to which the data subject has a right to receive, and the extent of the right to receive a complete “copy” thereof.
Faced with these questions, the CJEU determined, by way of a judgement, that the right to receive a “copy” of the personal data, set forth in article 15, section 3, of the GDPR, implies the handing over of an authentic and intelligible reproduction of the processed data, with the limit on the rights and the liberties of third parties, such as business secrets or intellectual property rights, in particular those which protect computer programmes.
The Court affirms that the usual meaning of the concept of “copy” must be taken into account, therefore the handing over of a summary does not coincide with the conditions of “reproduction or authentic transcription of an original” indicated by the Advocate General in the conclusions. Clarification is given on the concept of “copy” that it does not solely correspond to a document per se, but instead refers to all of the personal data subject to processing, including all of the information ensuing as a result thereof, such as the assessment of creditworthiness or the ability to pay.
The Court deems that through the access to personal data, the data subject is allowed to “ascertain that the personal data concerning him are exact and are lawfully processed”, enabling the data subject to exercise the right of rectification and deletion.
As for the question regarding the scope of the concept “information”, the Court determined that it only refers to personal data which must be facilitated by way of a “copy” by the party responsible for processing following the request from the data subject.
The Court, referring to the wording of article 12 of the GDPR, also clarifies the conditions under which the information must be provided to the data subject, which must be delivered in a “concise, transparent, intelligible and easily accessible form, in clear and plain language”.
Interpretative loopholes, which may have been drawn from article 15 of the GDPR, have been eliminated by way of this judgement, and the rights and obligations of the parties in the area of data protection are more clearly defined, thus enabling the data subjects to be able to access a greater amount of data.
Oscar Vilá
Vilá Abogados
For more information, please contact:
2nd June 2023
