In its judgment of 4 May 2023 in Case C-487/21, the Court of Justice of the EU (“CJEU”) commented on the interpretation of Article 15(3) of Regulation[1], which governs the right of the data subject to be provided with a copy of the personal data processed.

The preceding events consisted in the fact that the data subject F.F. requested access to his personal data processed by CRIF, which, as a consultancy agency, provides information on the solvency of third parties at the request of its clients. He also requested a copy of the documents (emails and database extracts) containing his personal data in a standard technical format. However, CRIF only sent him an aggregate list of the personal data processed. The data subject then lodged a complaint with the Austrian Data Protection Authority, which rejected the complaint, followed by an action by the data subject before the Austrian Federal Administrative Court.

The CJEU, which dealt with the preliminary question referred by the above-mentioned Austrian court, considered the scope of the obligation to provide the data subject with a “copy” of his personal data processed, or whether this obligation is fulfilled by the transmission of personal data in the form of an aggregate list, or whether this obligation also includes the transmission of extracts from documents or entire documents, including extracts from databases, in which the personal data are recorded.

According to the CJEU, Article 15(3) (first sentence) needs to be interpreted as meaning that the right to obtain from the controller a copy of the personal data processed implies that a faithful and intelligible reproduction of all such data must be provided to the data subject. A prerequisite for this right is the right to obtain a copy of extracts from documents or entire documents or extracts from databases containing, among other things, the data referred to, where the provision of such a copy is necessary to enable the data subject to effectively exercise the rights conferred by the Regulation.   

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “Regulation”).

Author: Veronika Odrobinová, Martina Šumavská