CJEU clarifies the scope of the right to obtain a copy of personal data under the GDPR

On 4 May 2023, the Court of Justice of the European Union (CJEU) handed down its judgment in F.F. v Austrian Data Protection Authority (DSB) (C-487/21). The judgment came in response to a request for a preliminary ruling from the Federal Administrative Court of Austria seeking clarification of the scope of the right of access under Article 15(3) of the GDPR.
The case arose in relation to a request for access to personal data, with the Austrian court asking whether the right of access under the GDPR is satisfied when the data controller provides personal data in the form of an aggregated statement, or whether the obligation also extends to providing extracts from documents, entire documents and extracts from databases containing personal data.
The CJEU held that the right to obtain a copy of personal data being processed under Article 15(3) of the GDPR requires that a true and intelligible reproduction of all relevant data be provided to the data subject. This includes the right to obtain a copy of excerpts of documents, whole documents or extracts from databases containing the data subject’s personal data, where this is necessary for the effective exercise of his or her rights without prejudice to the rights and freedoms of others. The CJEU emphasised that the term ‘copy’ refers to the personal data contained in the document and not to the document itself.
Furthermore, the CJEU clarified that the first sentence of Article 15(3) of the GDPR cannot be interpreted as creating a separate right from that provided for in Article 15(1) of the GDPR. The concept of “information” in the third sentence of Article 15(3) refers exclusively to personal data, a copy of which the controller must provide under the first sentence of Article 15(3) of the GDPR.

This ruling offers valuable guidance on the scope of the right to obtain a copy of personal data under the GDPR, clarifying the scope of the controller’s obligations and helping to ensure the effective exercise of data subjects’ rights.

LATEST POSTS

FIND US