Insights

On 4 May 2023, the European Court of Justice (“ECJ”) delivered a preliminary ruling in the case of F.F. v Österreichische Datenschutzbehörde (C-487/21), in relation to the interpretation of Article 15 of Regulation (EU) 2016/679 (the “GDPR”) on a data subject’s right of access to his/her data undergoing processing.

Background to the proceedings before the Federal Administrative Court of Austria

CRIF GmbH (“CRIF”), a business consultancy agency, was involved in the business of providing, at the request of its clients, information on the creditworthiness of third parties. As part of its business, CRIF had processed the personal data of the applicant. In December 2018, the applicant applied to CRIF, on the basis of Article 15 of the GDPR, for access to the personal data concerning him. The applicant also requested CRIF to provide him with a copy of the documents concerning his data, namely emails and database extracts, in a standard technical format. In response to this request, CRIF provided the applicant with a list of his personal data undergoing processing in summary form.

The applicant, feeling aggrieved with the summary form data that CRIF had provided, and being of the view that CRIF should have sent him a copy of all the documents containing his data including emails and database extracts, lodged a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde) (hereinafter, “DSB”).

In September 2019, the DSB rejected the complaint lodged by the applicant, stating that CRIF had not, in any way, infringed the right of access of the applicant to his personal data. The applicant therefore instituted proceedings against DSB before the Federal Administrative Court of Austria, concerning DSB’s refusal to require CRIF to send the applicant a copy of his personal data undergoing processing.

The Federal Administrative Court of Austria, tasked with hearing the action brought by the applicant against the DSB, was uncertain as to the scope of the first sentence of Article 15(3) of the GDPR, particularly, whether the obligation laid down in that provision to provide a ‘copy’ of the personal data is fulfilled where the controller transmits personal data in the form of a summary table or whether that obligation also entails the transmission of document extracts or entire documents, as well as database extracts, in which those data are reproduced.

Questions referred for a Preliminary Ruling

In view of the above, the Federal Administrative Court of Austria raised the following questions for a preliminary ruling:

1. whether the term “copy” in Article 15(3) of the GDPR was to be interpreted as meaning a photocopy, fax or electronic copy, or whether it should also be interpreted to mean a “transcript”;
2. whether the first sentence of Article 15(3) of the GDPR was to be interpreted as affording a general right for a data subject to: (i) obtain a copy of entire documents in which the personal data of that data subject are processed; (ii) to receive a copy of a database extract if the personal data are processed in such a database; or (iii) to receive only an exact reproduction of the personal data about which information is to be provided pursuant to Article 15(1) of the GDPR;
3. whether the first sentence of Article 15(3) is to be interpreted as meaning that, depending on the nature of the data processed, it may nevertheless be necessary in individual cases to make text passages or entire documents available to the data subject;
4. whether the term “information” is to be interpreted as referring solely to the “personal data undergoing processing” referred to in the first sentence of Article 15(3) of the GDPR.

Considerations of the ECJ

In considering the questions raised by the Federal Administrative Court of Austria, the ECJ examined the first three questions together. The ECJ noted that although the GDPR does not define the term ‘copy’, reference must be made to the usual meaning of such a term, which would mean the faithful reproduction or transcription of an original, with the result that a purely general description of the data undergoing processing or a reference to categories of personal data would not correspond to that definition.

Making reference to the definition of personal data in the GDPR, the ECJ noted that the concept of personal data is defined as ‘any information relating to an identified or identifiable natural person’ and specifies that ‘an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.

The ECJ held that information shall be deemed to relate to an identified or identifiable natural person where, by reason of its content, purpose or effect, it is linked to an identifiable person.

The ECJ noted that based on the literal analysis of the first sentence of Article 15(3) of the GDPR, said provision confers on the data subject the right to obtain, from the data controller, a faithful reproduction of his or her personal data that are subject to operations that can be classified as processing. The Court, referred to the European Commission’s written observations, noting that the term ‘copy’ does not relate to a document as such, but to a copy of the personal data. The term ‘copy’ should therefore be interpreted as being a copy of all the personal data undergoing processing by the data controller.

The ECJ further explained that the right of access granted by Article 15 of the GDPR is intended to enable the data subject to exercise, depending on the circumstances, his or her right to rectification, right to erasure, or right to restriction of processing, as well as the data subject’s right to object to his or her personal data being processed. The Court furthermore noted that the GDPR grants the data subject the right of action where he or she suffers damage.

The ECJ also pointed out that the controller is obliged to take the necessary measures to provide the data subject with all the relevant information in a concise, transparent, intelligible and easily accessible form, using plain and clear language, and that the information must be provided in writing or by electronic means, unless the data subject requests that it be provided orally. The Court noted that the purpose of the provision is to ensure that the data subject is able to fully understand the information shared with him or her.

The Court noted that in any event, the right to obtain a copy referred to in Article 15(3) of the GDPR should not adversely affect the rights and freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. The Court pointed out that in the event of conflict between, on the one hand, exercising the right of full and complete access to personal data, and, on the other hand, the rights and freedoms of others, a balance would need to be struck between the rights in question.

Ruling of the ECJ

The Court therefore ruled that the answers to the first, second and third questions must be interpreted as meaning that the right to obtain, from the controller, a copy of the personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. The Court stated that such a right entails the right to obtain copies of extracts from documents or even entire documents or extracts/databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by the GDPR, bearing in mind that account must be taken, in that regard, of the rights and freedoms of others.

In respect of the fourth question, the Court held that the third sentence of Article 15(3) of the GDPR must be interpreted as meaning that the concept of information to which it refers relates exclusively to the personal data of which the controller must provide a copy pursuant to the first sentence of that paragraph.

Disclaimer: Ganado Advocates is responsible for contributing this law report but was not in any way involved as legal advisor for the parties in the judgement being covered in this law report.

This article was first published on The Malta Independent on 24/05/2023.