GDPR: Right to access information. Court of Justice clarifies the concepts of “copy” and “information”.

Article 15(3) GDPR provides that, at the request of the data subject, the controller must provide a copy of the personal data that has been processed and, if the request is made electronically, provide the information in a commonly used electronic form. The ECJ clarifies that the right to obtain a “copy” of personal data means that a true and intelligible reproduction of all those data must be given to the data subject and that the term “information” refers only to the personal data of which a copy must be provided.

On the basis of Article 15(1) GDPR, every data subject has the right to access personal data relating to him or her that have been processed. Paragraph 3 provides that, at the request of the data subject, the controller must provide a copy of the personal data that has been processed and, if the request is made electronically, provide the information in a commonly used electronic form. In a judgment of 4 May 2023, the Court clarified the concepts of “copy” and “information”.

The ECJ provided these clarifications in response to preliminary questions raised by the Austrian Bundesverwaltungsgericht in a case in which a business consultancy had sent the personal data it had processed only in aggregated form to a data subject who had exercised his right of access. The claimant subsequently filed a complaint with the Austrian data protection authority, arguing that the business consultancy should have provided a copy of all documents containing his data.

In its judgment, the ECJ clarifies the content and scope of the data subject’s right to access personal data relating to him that have been processed. The Court points out that the term “copy” does not refer to a document as such, but to the personal data it contains, which must be complete. According to the Court, it follows from the GDPR that the controller must provide the data subject with all the information in question in a concise, transparent, intelligible and easily accessible, using clear and plain language, and that the information must be provided in writing or by other means, including by electronic means, unless the data subject requests the information to be provided orally. It follows that the copy must present all the necessary characteristics to enable the data subject to effectively exercise his or her rights deriving from the GDPR. This copy must therefore reproduce the data fully and faithfully.

To ensure that the information provided is comprehensible, it may therefore be necessary to reproduce extracts from documents or even complete documents or database extracts containing, among others, the personal data processed. In particular, where personal data are generated on the basis of other data or where such data result from open text fields, the context in which such data are processed is an indispensable element to enable the data subject to transparently access and understand such data.

The ECJ nevertheless specifies that the right of access does not affect the rights and freedoms of others. In the event of a conflict between the full exercise of the right of access to personal data on the one hand and the rights or freedoms of others on the other, such rights shall be balanced against each other. As far as possible, a choice should be made to provide the personal data in a way that does not infringe the rights or freedoms of others, without depriving the data subject of all information.

The ECJ further addresses the question of what is to be understood by the term “information” within the meaning of Article 15(3) GDPR. The Court clarifies that this concept refers only to personal data of which a copy must be provided.

Key message

Following the judgment of the Court of Justice, the controller who, on the basis of the right of access, has to provide the data subject with a copy of the personal data processed, will always have to strike a careful balance between: 

• the obligation to transmit a true and intelligible reproduction of all personal data processed, whereby it may be necessary in certain cases to reproduce complete documents; and the
• rights or freedoms of others.