Case C‑487/21
F.F.
v
Österreichische Datenschutzbehörde and CRIF GmbH
(Request for a preliminary ruling from the Bundesverwaltungsgericht (Austria))
Judgment of the Court (First Chamber), 4 May 2023
(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Data subject’s right of access to his or her data undergoing processing – Article 15(3) – Provision of a copy of the data – Concept of ‘copy’ – Concept of ‘information’)
1. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Provision of a copy of the data – Concept of ‘copy’ – Delivery to a data subject of a faithful and intelligible reproduction of those data – Copy of extracts from documents or even entire documents or extracts from databases containing, inter alia, those data – Included – Condition
(European Parliament and Council Regulation 2016/679, recitals 58 and 60 and Arts 12(1) and 15(1) and (3), first sentence)
(see paragraphs 21, 28, 32, 36-45, operative part 1)
2. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Provision of a copy of the data – Concept of information – Personal data that must be provided by the controller in the form of a copy – Included
(European Parliament and Council Regulation 2016/679, Art. 15(3), third sentence)
(see paragraphs 48-53, operative part 2)
Résumé
GDPR: the right to obtain a ‘copy’ of personal data means that the data subject must be given a faithful and intelligible reproduction of all those data
That right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases which contain those data, if that is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by that regulation
CRIF is a business consulting agency that provides, at the request of its clients, information on the creditworthiness of third parties. It was for that purpose that it processed the personal data of the applicant in the main proceedings, an individual. The latter applied to CRIF, on the basis of the General Data Protection Regulation, (1) for access to personal data concerning him. In addition, he asked to be provided with a copy of the documents, namely emails and database extracts containing, inter alia, his data, ‘in a standard technical format’.
In response to that request, CRIF sent the applicant in the main proceedings, in summary form, the list of his personal data undergoing processing. Being of the view that CRIF should have sent him a copy of all of the documents containing his data, such as emails and database extracts, the applicant in the main proceedings lodged a complaint with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority). That authority rejected the complaint, taking the view that CRIF had not in any way infringed the right of access of the applicant in the main proceedings to his personal data.
The Bundesverwaltungsgericht (Federal Administrative Court, Austria), hearing the action brought by the applicant in the main proceedings against the rejection decision adopted by that authority, is uncertain as to the scope of the obligation laid down in the first sentence of Article 15(3) of the GDPR to provide the data subject with a ‘copy’ of his or her personal data undergoing processing. That court is uncertain, in particular, whether that obligation is fulfilled where the controller transmits the personal data in the form of a summary table or whether that obligation also entails the transmission of document extracts or even entire documents, as well as extracts from databases, in which those data are reproduced. The referring court also seeks clarification of what precisely is covered by the concept of ‘information’ in the third sentence of Article 15(3) of the GDPR. (2)
By its judgment, the Court provides clarification on the content and scope of the data subject’s right of access to his or her personal data undergoing processing. In that regard, it considers that the right to obtain from the controller a ‘copy’ of the personal data undergoing processing pursuant to the first sentence of Article 15(3) of the GDPR means that the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by the GDPR, bearing in mind that account must be taken, in that regard, of the rights and freedoms of others. Furthermore, the Court states that the concept of ‘information’ referred to in the third sentence of Article 15(3) of the GDPR relates exclusively to personal data of which the controller must provide a copy pursuant to the first sentence of that paragraph.
Findings of the Court
In the first place, the Court gives a literal, systematic and teleological interpretation of the first sentence of Article 15(3) of the GDPR, which provides for the right of the data subject to obtain a copy of his or her personal data undergoing processing.
As regards the wording of the first sentence of Article 15(3) of the GDPR, the Court notes that, although that provision does not contain a definition of the term ‘copy’, account must be taken of the usual meaning of that term, which refers to the faithful reproduction or transcription of an original, with the result that a purely general description of the data undergoing processing or a reference to categories of personal data does not correspond to that definition. Furthermore, it is apparent from the wording of that provision that the disclosure obligation relates to the personal data undergoing the processing in question. After conducting a literal analysis of that provision, the Court holds that it confers on the data subject the right to obtain a faithful reproduction of his or her personal data, understood in a broad sense, that are subject to operations that can be classified as processing carried out by the controller.
Regarding the context of which the first sentence of Article 15(3) of the GDPR forms part, the Court notes that Article 15 of the GDPR defines, in paragraph 1 thereof, the subject matter and scope of the data subject’s right of access. Article 15(3) of the GDPR sets out the practical arrangements for the fulfilment of the controller’s obligation, specifying, inter alia, in its first sentence, the form in which that controller must provide the personal data undergoing processing, namely in the form of a ‘copy’. As a result, the first sentence of Article 15(3) of the GDPR cannot be interpreted as establishing a separate right from that provided for in Article 15(1) of the GDPR. Moreover, the Court notes that the term ‘copy’ does not relate to a document as such, but to the personal data which it contains and which must be complete. The copy must therefore contain all the personal data undergoing processing.
With regard to the objectives pursued by Article 15 of the GDPR, the Court notes that the right of access provided for in that article must enable the data subject to ensure that the personal data relating to him or her are correct and that they are processed in a lawful manner.
In addition, according to the Court, it is apparent from the GDPR (3) that the controller is obliged to take appropriate measures to provide the data subject with all the information referred to, in a concise, transparent, intelligible and easily accessible form, using plain and clear language, and that the information must be provided in writing or by other means, including, where appropriate, by electronic means, unless the data subject requests that it be provided orally. It follows that the copy of the personal data undergoing processing, which the controller must provide, must have all the characteristics necessary for the data subject to exercise his or her rights under that regulation effectively and must, consequently, reproduce those data fully and faithfully.
Accordingly, in order to ensure that the information thus provided is easy to understand, the reproduction of extracts from documents or even entire documents or extracts from databases which contain, inter alia, the personal data undergoing processing may prove essential. In particular, where personal data are generated from other data or where such data result from empty fields, that is to say where there is an absence of information which provides information about the data subject, the context in which the data are processed is an essential element in enabling the data subject to have transparent access and an intelligible presentation of those data.
In the event of conflict between, on the one hand, exercising the right of full and complete access to personal data and, on the other hand, the rights or freedoms of others, the Court takes the view that a balance will have to be struck between the rights and freedoms in question. Wherever possible, means of communicating personal data that do not infringe the rights or freedoms of others should be chosen, bearing in mind that the result of those considerations should not be a refusal to provide all information to the data subject.
In the second place, the Court examines what is covered by the concept of ‘information’ referred to in the third sentence of Article 15(3) of the GDPR. Although that provision does not specify what is to be understood by the term ‘information’, it follows from its context that the ‘information’ to which it refers necessarily corresponds to the personal data of which the controller must provide a copy in accordance with the first sentence of that paragraph.