Court of Justice of the European Communities (including Court of First Instance Decisions)

OPINION OF ADVOCATE GENERAL

PITRUZZELLA

delivered on 15 December 2022(1)

Case C‑487/21

F.F.

interested parties:

Österreichische Datenschutzbehörde,

CRIF GmbH

(Request for a preliminary ruling
lodged by the Bundesverwaltungsgericht (Federal Administrative Court, Austria))

(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(3) – Right of access by the data subject to personal data undergoing processing – Right to receive a copy of personal data – Concept of ‘copy’ – Concept of ‘information’)

1.        What is the content and what is the scope of the right conferred on the data subject who obtains access to his or her personal data that are undergoing processing to receive a copy of those data, as provided for by Article 15(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2) (‘the GDPR’)? What is the meaning of the term ‘copy’ and how does such a right to receive a copy of personal data that are undergoing processing tie in with the right of access as provided for in Article 15(1)?

2.        These are, essentially, the main questions that arise in the case to which the present Opinion relates, which concerns a reference for a preliminary ruling made by the Bundesverwaltungsgericht (Federal Administrative Court, Austria) concerning the interpretation of Article 15(3) of the GDPR.

3.        This request forms part of a dispute that has arisen between Mr F.F. and the Österreichische Datenschutzbehörde (Austrian Data Protection Authority) concerning the legality of the latter’s rejection of Mr F.F.’s request that a business consulting agency that had processed his personal data be ordered to provide documents and extracts from a database containing the abovementioned personal data.

4.        The present case will provide the Court with an opportunity to interpret for the first time Article 15(3) of the GDPR and to provide clarification on the modalities for the exercise of the right of access to one’s personal data undergoing processing as provided for by Article 15 of the GDPR.

I.      Legal framework

5.        Recital 63 of the GDPR states:

‘A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject …’

6.        Article 4(1) and (2) of the GDPR provides:

‘For the purposes of this Regulation:

(1)      “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(2)      “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;’

7.        Article 12(1) of the GDPR, entitled ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, provides:

‘The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.’

8.        Article 15 of the GDPR, entitled ‘Right of access by the data subject’, provides:

‘1.      The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a)      the purposes of the processing;

(b)      the categories of personal data concerned;

(c)      the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d)      where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e)      the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f)      the right to lodge a complaint with a supervisory authority;

(g)      where the personal data are not collected from the data subject, any available information as to their source;

(h)      the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

…

3.      The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

4.      The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.’

II.    The facts in the main proceedings and questions referred for a preliminary ruling

9.        CRIF GmbH is a business consulting agency that provides, at the request of its clients, information on the creditworthiness of third parties. It was for that purpose that it processed the personal data of the applicant in the main proceedings.

10.      On 20 December 2018, that person approached the agency to obtain, inter alia, information on his personal data that were undergoing processing pursuant to Article 15 of the GDPR, requesting in particular a copy of that data in a standard technical format.

11.      Following that request, the agency provided some of the requested information as an aggregate that reproduced the stored personal data of the applicant in the main proceedings, first, in a table broken down by name, date of birth, street, postal code, and place, and, second, in a statement summarising corporate functions and powers of representation. However, no other documents such as emails or extracts from databases were sent.

12.      On 16 January 2019, the applicant in the main proceedings filed a complaint with the Austrian Data Protection Authority, in which he claimed that the response to his request was incomplete and, in particular, that the controller should have sent him a copy of all the documents, including the emails and database extracts, that contained his personal data.

13.      By a decision dated 11 September 2019, the abovementioned authority rejected the complaint, finding that the controller had not in any way infringed the right of access of the applicant in the main proceedings to his personal data.

14.      The referring court, before which an action against that decision was brought, has doubts as to the scope of the data subject’s right, guaranteed by the first sentence of Article 15(3) of the GDPR, to receive copies of the personal data undergoing processing.

15.      That court must decide whether the transmission of the personal data of the applicant in the main proceedings in the form of a table and a summary statement contained in the agency’s response to the request for access complies with the requirements of Article 15(3) of the GDPR or whether, under that provision, the applicant in the main proceedings is entitled to obtain a copy of his personal data undergoing processing not in a manner devoid of context, but in the form of copies or extracts of any correspondence or contents of databases or similar documentation.

16.      In that context, that court seeks, in the first place, clarification as to the exact meaning of the concept of a ‘copy’ of the personal data undergoing processing, which is referred to in the first sentence of Article 15(3) of the GDPR.

17.      In the second place, that court asks whether Article 15(3) of the GDPR clarifies the general right of access referred to in paragraph 1 of that article, which sets out how the data subject must obtain access to his or her personal data undergoing processing, or whether that provision, going beyond the abovementioned right of access under paragraph 1, provides for its own independent right to obtain photocopies, facsimiles, printouts or electronic extracts of databases or copies of documentation and files in their entirety that contain the data subject’s personal data.

18.      In the third place, in the event of a restrictive interpretation of the first sentence of Article 15(3) of the GDPR in the sense that the concept of ‘copy’ does not presuppose the existence of a right to the transmission of photocopies, documents or extracts from databases, the referring court has doubts whether, nevertheless, in the light of the possible different types of data that can undergo processing and the principle of transparency set out in Article 12(1) of the GDPR, the controller might not, in certain cases, depending on the type of data processed, be obliged nevertheless to provide portions of text or copies of documents.

19.      In the fourth place, and lastly, the referring court asks whether the concept of ‘information’, which appears in the third sentence of Article 15(3) of the GDPR, covers only the ‘personal data undergoing processing’ referred to in the first sentence of that provision or goes beyond that to include also the information referred to in Article 15(1)(a) to (h) of the GDPR or, going even further, encompasses also, for example, metadata about data.

20.      In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1)      Is the term “copy” in Article 15(3) of [the GDPR] to be interpreted as meaning a photocopy, a facsimile or an electronic copy of [an] (electronic) item of data, or does it also cover an “Abschrift”, a “double” (“duplicata”) or a “transcript”, in line with the understanding of the term in German, French and English dictionaries?

(2)      Is the first sentence of Article 15(3) of the GDPR, according to which “the controller shall provide a copy of the personal data undergoing processing”, to be interpreted as affording a general right for a data subject to obtain a copy of – also – entire documents in which the personal data of that data subject are processed, or to receive a copy of a database extract if the personal data are processed in such a database, or does the data subject have a right – only – to an exact reproduction of the personal data about which information is to be provided pursuant to Article 15(1) of the GDPR?

(3)      In the event that Question 2 is answered to the effect that the data subject has a right only to an exact reproduction of the personal data about which information is to be provided pursuant to Article 15(1) of the GDPR, is the first sentence of Article 15(3) of the GDPR to be interpreted as meaning that, depending on the nature of the data processed (for example in relation to the diagnoses, examination results and assessments mentioned in recital 63 or documents in relation to an examination within the meaning of the [judgment in Nowak (3)] and the transparency requirement in Article 12(1) of the GDPR, it may nevertheless be necessary in individual cases to make text passages or entire documents available to the data subject?

(4)      Is the term “information” which, pursuant to the third sentence of Article 15(3) of the GDPR, “where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, … shall be provided in a commonly used electronic form”, to be interpreted as referring solely to the “personal data undergoing processing” mentioned in the first sentence of Article 15(3) of the GDPR?

(a)      If Question 4 is answered in the negative: Is the term “information” which, pursuant to the third sentence of Article 15(3) of the GDPR, “where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, … shall be provided in a commonly used electronic form” to be interpreted as also referring to the information pursuant to Article 15(1)(a) to (h) of the GDPR?

(b)      If Question 4a also is answered in the negative: Is the term “information” which, pursuant to the third sentence of Article 15(3) of the GDPR, “where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, … shall be provided in a commonly used electronic form” to be interpreted as referring, beyond the “personal data undergoing processing” and the information pursuant to Article 15(1)(a) to (h) of the GDPR, to associated metadata, for example?’

III. Legal analysis

A.      The first, second and third questions referred for a preliminary ruling

21.      By the first three questions it refers for a preliminary ruling, which in my view it is appropriate to examine together, the referring court asks the Court three questions aimed at determining the scope of the first sentence of Article 15(3) of the GDPR, under which ‘the controller shall provide a copy of the personal data undergoing processing’.

22.      The first question is aimed at determining the exact meaning of the concept of ‘copy’ contained in that provision. The second question is aimed at clarifying the scope of the right that that provision confers on the data subject. The referring court has doubts, in particular, whether that provision gives the data subject the right to obtain a copy also of the documents – or of extracts from databases – in which personal data are processed or whether it merely confines itself to conferring the right to receive a faithful reproduction of the original personal data that undergo processing. In the latter case, the third question is aimed at ascertaining whether, depending on the type of data processed and in accordance with the principle of transparency, it might nonetheless be necessary in some cases to provide also portions of text or entire documents.

23.      It follows from the order for reference that the scope of the first sentence of Article 15(3) of the GDPR is a subject of controversy, both in doctrine and in national case-law, at least in Austria and Germany. (4) It follows from that order that there are two opposing theories in that regard: on the one hand, a restrictive interpretation of the provision in question, according to which that provision merely clarifies the modalities in respect of the right of access and does not imply any autonomous right to obtain documents or the like, and, on the other hand, a broad interpretation, according to which, by contrast, that provision does confer on the data subject the right to receive a copy of the documents or other media on which personal data are processed. Under the latter interpretation, the right to obtain copies of documents constitutes a right independent of the right of access guaranteed by Article 15(1) of the GDPR. The disputed nature of the scope of the provision in question is confirmed by the fact that the parties that submitted observations before the Court also have different positions on that issue. (5)

24.      In that context, in order to be able to provide an answer to the first three questions referred for a preliminary ruling, the first sentence of Article 15(3) of the GDPR needs to be interpreted.

25.      In that regard, it should be borne in mind that it is settled case-law that, for the purpose of interpreting a provision of EU law, it is necessary to consider not only its wording but also its context and the objectives of the legislation of which it forms part. (6)

26.      Furthermore, since the provisions of the GDPR govern the processing of personal data liable to infringe fundamental freedoms and, in particular, the right to respect for private life, they must necessarily be interpreted in the light of the fundamental rights guaranteed by the Charter of Fundamental Rights of the European Union (‘the Charter’). (7)

1.      Literal analysis

27.      Regarding, first of all, the wording of the first sentence of Article 15(3) of the GDPR, it should be noted that it gives the data subject the right to obtain from the controller ‘a copy of the personal data undergoing processing’. From a literal point of view, that wording refers to three distinct concepts, namely the concept of ‘copy’, the concept of ‘personal data’, and the concept of ‘undergoing processing’.

28.      Regarding, in the first place, the concept of ‘copy’, the scope of which is specifically the subject of the first question referred for a preliminary ruling, it should be noted that, as various interested parties that have submitted observations to the Court have claimed, the GDPR does not contain any specific definition of that concept.

29.      In that context, it follows from settled case-law that the meaning and scope of terms for which EU law provides no definition must be determined by reference to their usual meaning in everyday language, while account is also taken of the context in which they occur and the purposes of the rules of which they form part. (8)

30.      From a purely terminological point of view, the term ‘copy’ in current linguistic usage refers to the faithful reproduction or transcription of an original.(9) Moreover, an analysis of the various language versions of the GDPR shows that, in most other official languages of the European Union, the term corresponding to the Italian term ‘copia’ is used, such as, for example, ‘copy’ in English, ‘Kopie’ in German, ‘copie’ in French, and ‘copia’ in Spanish. (10)

31.      Furthermore, the provision in question makes explicit that the copy that the controller is required to provide to the data subject is the copy of the ‘personal data’ undergoing processing.

32.      In that regard, and in the second place, it should be noted that, unlike with the term ‘copy’, the GDPR does explicitly define the concept of ‘personal data’, in Article 4(1) of that regulation, according to which personal data are ‘any information relating to an identified or identifiable natural person’.

33.      The scope of the concept of ‘personal data’ resulting from that definition is very broad. As can be inferred from the Court’s case-law, the use of the expression ‘any information’ in that definition reflects the aim of the EU legislature to assign a wide scope to that concept. (11)

34.      Accordingly, it follows from the case-law that the concept of personal data is not restricted to information that is sensitive or private, but potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it is ‘relating’ to the data subject. The latter condition is satisfied where the information, by reason of its content, purpose, or effect, is linked to a particular person. (12)

35.      The concept of ‘personal data’ needs then to be understood in a broad sense, given the variety of types and forms that information relating to a person can take and that may be worthy of protection, as well as in the light of the variety of media in which such information can be contained.

36.      Analysis of the case-law shows that the Court has considered a variety of types of information relating to an identified or identifiable natural person to come within the concept of ‘personal data’ within the meaning of Article 4(1) of the GDPR. In addition to what the Commission in its observations defined as ‘usual data’, namely particulars concerning the identity of persons, such as first and last name, (13) date of birth, nationality, gender, ethnicity, religion, and the language spoken by a person as identifiable by his or her name, (14) the Court has considered other types of information to come within the concept of personal data, such as, for example, information concerning a motor vehicle offered for sale, as well as the telephone number of the seller of that motor vehicle, (15) or data contained in a record of working time which concern, in relation to each worker, the daily work periods and rest periods, (16) the image of a person recorded by a camera in so far as it makes it possible to identify the person concerned, (17) written answers submitted by a candidate in a professional examination and the examiner’s comments thereon, (18) or even information relating to penalty points, which concerns an identified natural person. (19)

37.      The broad interpretation of the concept of personal data resulting from the definition in Article 4(1) of the GDPR, which is recognised by the case-law and linked to the objective pursued by the GDPR of ensuring a high level of protection of natural persons in respect of the processing of personal data, (20) means that that concept, and therefore the right to access and receive copies of such data, is not limited exclusively to data that might have been acquired, stored and processed by a controller, but must also include any further data that might have been generated by that controller as a result of the processing, if such data also undergo processing.

38.      Therefore, if, following the processing of a set of personal data, new information is generated as a result, relating to an identified or identifiable person, which could be classified as personal data within the meaning of Article 4(1) of the GDPR, the data subject’s right to have access to personal data and to receive a copy thereof, provided for in Article 15(1) of the GDPR and the first sentence of Article 15(3) of the GDPR, respectively, must, in my view, also include such generated data, if such data themselves undergo processing. The right to access data and to receive a copy thereof includes all the data subject’s personal data that undergo processing.

39.      These considerations are relevant in a case such as the one pending before the referring court, where, on the basis of data collected from various sources, the business consulting agency appears to have drawn up a recommendation with regard to the data subject’s creditworthiness and willingness to pay, on the basis of statistical probability related to a number of parameters. Such a recommendation constitutes, in my view, information concerning an identified person, which therefore comes within the broad sense of ‘personal data’ under Article 4(1) of the GDPR and thus, also, within the scope of the right of access under Article 15(1) of the GDPR and the first sentence of Article 15(3) of the GDPR. (21)

40.      In the third place, in respect of the expression ‘undergoing processing’ contained in the first sentence of Article 15(3) of the GDPR, it should be noted that the concept of ‘processing’ is also explicitly defined in Article 4(2) of the GDPR.

41.      According to that provision, the collection, consultation, disclosure by transmission or otherwise making available of personal data constitute ‘processing’ within the meaning of that regulation. According to the case-law, it follows from the wording of that provision, in particular from the expression ‘any operation’, that the EU legislature also intended to give the concept of ‘processing’ a broad scope. That interpretation is corroborated by the non-exhaustive nature, expressed by the phrase ‘such as’, of the operations referred to in that provision. (22)

42.      In that context, it follows from the broad interpretation of the concept of processing that the first sentence of Article 15(3) of the GDPR confers on the data subject the right to obtain a copy of his or her personal data that undergo any operation that can be classified as ‘processing’. As will be set out in more detail in point 52 below, that provision, however, does not, as such, give the data subject the right to obtain specific information as to the processing of the personal data itself, other than that provided for in Article 15(1) of the GDPR.

43.      To conclude, it follows from the literal analysis of the first sentence of Article 15(3) of the GDPR that that provision confers on the data subject the right to obtain a copy of his or her personal data, understood in a broad sense, that undergo operations that can be classified as processing on the part of the controller.

44.      That literal analysis allows the finding that the ‘copy of personal data’ must be a faithful reproduction of those data. However, the variety of types of data that may undergo processing means that, depending on the type of data processed and the type of processing, a copy of those data may be in different formats, such as paper, audio or video recording, electronic or other formats. The important thing is that the copy of such data is faithful and allows the data subject to have full knowledge of all the data undergoing processing. Any compilation of personal data that undergo processing must faithfully and comprehensibly reproduce such data and, moreover, must not influence in any way the content of the data to be provided. The choice on the part of the controller to provide, where possible, a compilation of the personal data undergoing processing cannot therefore warrant some data being omitted or provided incompletely or not reflecting the reality of the processing.

45.      Moreover, the provision in question guarantees the data subject the right to receive a copy of all of his or her personal data that undergo processing, and thus not only of the data acquired, but also of any personal data generated by the controller that undergo processing. However, in so far as that provision refers exclusively to the copy of personal data, it, first, cannot form the basis of a right to access information that cannot be classified as such and, second, does not – necessarily – grant the data subject the right to receive copies of documents or of other media containing personal data.

46.      However, these considerations must be complemented by an analysis of the context of which that provision forms part and of the objectives pursued by the right of access guaranteed by Article 15 of the GDPR.

2.      Contextual and teleological interpretations

47.      With regard to the context of which the provision at issue forms part, it should, first of all, be noted that it is included in Article 15 of the GDPR, which governs the right of the data subject, exercisable against controllers, to access personal data concerning him or her and undergoing processing. That article in the GDPR gives specific expression to the right of every individual to access data relating to him or her, enshrined in the second sentence of Article 8(2) of the Charter. (23)

48.      With regard to the structure of Article 15 of the GDPR, paragraph 1 thereof provides for the right of the data subject to obtain from the controller confirmation as to whether his or her personal data are being processed and, where that is the case, access to those data and to the information specified in points (a) to (h). That provision thus gives specific expression to the right of access to personal data and related information, defining the precise subject matter of the right of access and the scope of application.

49.      Article 15(3) of the GDPR, on the other hand, provides more details as to how that right is to be exercised, specifying in particular the form in which the controller must provide the data subject with personal data, that is to say, in the form of a copy and, therefore, a faithful reproduction of the data.

50.      It follows from the structure just outlined of Article 15 of the GDPR, as well as from the need for the provisions of paragraphs 1 and 3 of that article to be interpreted consistently, that paragraph 3 does not define – nor, therefore, can it modify or extend – the subject matter and scope of application of the right of access that is given specific expression by paragraph 1. The abovementioned paragraph 3 cannot therefore extend the scope of the controller’s obligation to provide access to information. The structure of the article in question therefore confirms that paragraph 3 cannot form the basis of any autonomous right on the part of the data subject to obtain information beyond that specified in paragraph 1 of that provision.

51.      In that regard, I agree with the Austrian Data Protection Authority when it argues that an interpretation of the first sentence of Article 15(3) of the GDPR to the effect that that provision allows the scope of information to which a data subject has access to be extended beyond that concerning his or her personal data would be contrary to Article 8(2) of the Charter.

52.      The foregoing analysis, first, confirms the assertion in point 44 above that the first sentence of Article 15(3) of the GDPR does not confer on data subjects an autonomous right to receive copies of documents or other media containing personal data. Second, it confirms also the analysis in point 42 above, according to which that provision does not confer on the data subject the right to obtain information, other than that provided for in Article 15(1) of the GDPR, (24) with regard to the processing itself of the personal data, such as, for example, information regarding the criteria, models, rules, or internal procedures (whether or not computational) used for processing the personal data. Such information is, moreover, often covered by intellectual property rights, which must be protected in that context, as follows explicitly from the fifth sentence of recital 63 of the GDPR. This does not detract, however, from the fact that, as follows from recital 60 of the GDPR, the controller must provide the data subject with any further information necessary to ensure fair and transparent processing, taking into account the specific circumstances and the context in which personal data are processed. It must also be borne in mind that there are specific rules concerning automated decision-making, including profiling. (25)

53.      Again from the point of view of context, the first sentence of Article 15(3) of the GDPR must be read in the light of the other relevant provisions of the GDPR. Apart from the definitions in Article 4(1) and (2) of the GDPR analysed in points 32 to 41 above, particular relevance is attributed to Article 12(1) of the GDPR, to which the referring court refers in the third question.

54.      It follows from that provision that the controller is obliged to take appropriate measures to provide the data subject with all the information referred to, inter alia, in Article 15 of the GDPR, in a concise, transparent, intelligible and easily accessible form, using plain and clear language, and that the information must be provided in writing or by other means, including, where appropriate, by electronic means, unless the data subject requests that it be provided orally.

55.      The purpose of that provision, an expression of the principle of transparency, (26) is to ensure that the data subject is able fully to understand the information sent to him or her. That the information be fully intelligible is, first, necessary for the rights of access guaranteed by Article 15 of the GDPR to be exercised effectively and, second, a prerequisite for being able fully to exercise the other rights that the GDPR guarantees for the data subject, which are referred to in points 64 and 65 of this Opinion and are subsequent to the exercise of the right of access. (27) It follows, moreover, from the rest of recital 63 of the GDPR that a data subject must be entitled to exercise the right of access to his or her personal data easily and without difficulty.

56.      The need for data to be communicated intelligibly so that the data subject can fully become aware of the data and check that they are accurate and processed in compliance with EU law in order to exercise the rights conferred on him or her by that law was, moreover, already emphasised by the Court in its case-law concerning Directive 95/46. (28)

57.      The abovementioned need for the data and the information set out in points (a) to (h) of Article 15(1) of the GDPR to be intelligible means that it is not ruled out that in some cases, in order to ensure the full intelligibility of the information sent to the data subject, it might be necessary to provide the latter with passages of documents or even entire documents or extracts from databases. The need to provide documents or extracts in order to ensure the intelligibility of the information sent must, however, inevitably be analysed on a case-by-case basis depending on the type of data being requested and the request itself.

58.      In that regard, it should be pointed out, however, that any communication of documents or extracts therefrom will not constitute the exercise of an autonomous right – as opposed to the right of access – guaranteed by the first sentence of Article 15(3) of the GDPR, but only a means of sending copies of personal data with the aim of ensuring that such data are fully intelligible. In that respect, I note that, as claimed by some of the interested parties that have submitted observations to the Court, it is certainly necessary in some cases, in order to have a full understanding of the personal data in question, to be aware of the context in which those data are processed. However, that does not mean that the data subject should, on the basis of the provision in question, be given a generalised right to access copies of documents or extracts from databases.

59.      Moreover, the right to obtain copies of personal data is limited by the need, explicitly provided for in Article 15(4) of the GDPR, not to ‘adversely affect the rights and freedoms of others’. It follows from that provision that the requirement to ensure that the data subject has full and complete access to his or her personal data by providing him or her with a copy thereof cannot go so far as to permit the infringement of the rights and freedoms of others.

60.      In that regard, I note that the abovementioned paragraph 4 is worded very broadly and leaves open the list of rights and freedoms ‘of others’ that might mitigate the exercise of a right to full access by means of receiving copies of personal data. However, it must be assumed that those rights certainly include, as follows explicitly from recital 63 of the GDPR, ‘trade secrets or intellectual property and in particular the copyright protecting the software’, as well as the right to the protection of personal data of third parties, such as where a medium containing the data subject’s personal data contains also third-party personal data.

61.      In the event of conflict between, on the one hand, exercising the right of full and complete access to personal data and, on the other hand, the rights or freedoms of others, a balance will have to be struck between the rights in question. Wherever possible, means of communicating personal data that do not infringe the rights or freedoms of others will have to be chosen, bearing in mind, however, that, as follows from recital 63 of the GDPR, they should not result in ‘a refusal to provide all information to the data subject’.

62.      Again from the point of view of context, it should also be noted that an interpretation of the first sentence of Article 15(3) of the GDPR to the effect that that provision does not grant a general right of access to copies of documents or extracts from databases, unless that is necessary to ensure the intelligibility of the data and information provided, is also confirmed by the fact that the right of access to documents, in particular administrative documents, is expressly governed by other EU acts (29) or national acts that pursue objectives other than those that guarantee the protection of personal data. (30)

63.      The interpretation of the first sentence of Article 15(3) of the GDPR referred to in the preceding point is then confirmed by an analysis of the purpose of that provision in the context of the data subject’s right of access as guaranteed by Article 15 of the GDPR.

64.      As follows from recital 63 of the GDPR, and in particular the first sentence thereof, the purpose of the right of access to one’s personal data and the other information set out in points (a) to (h) of Article 15(1) of the GDPR is, first and foremost, to enable the data subject to be aware of the processing of his or her data and to verify the lawfulness of that processing. (31)

65.      That right of access is necessary, as, moreover, previously noted by the Court, in order to enable the data subject to exercise a number of other rights conferred by the GDPR, including the right to rectification, the right to erasure (‘right to be forgotten’), and the right to restriction of processing, conferred by Articles 16, 17, and 18 of the GDPR, respectively. (32) The Court further clarified that the right of access is also necessary to enable the data subject to exercise his or her right to object under Article 21 of the GDPR to his or her personal data being processed or the right to bring an action where he or she suffers damage and to receive compensation for the damage suffered, for the purposes of Articles 79 and 82 of the GDPR. (33)

66.      It is in the context of the objectives of the right of access to one’s personal data and other information that the rationale behind the rule conferring the right to obtain a copy of personal data must be understood. It is aimed at making explicit provision for the form that guarantees the data subject effective exercise of that right in order to enable him or her to satisfy himself or herself as to the fairness and lawfulness of the processing for the purpose, where appropriate, of exercising the further rights referred to in point 65 above. The aim is to ensure that the data subject is provided with personal data in as accurate and comprehensible a form as possible to enable him or her to exercise those rights, namely in the form of a copy, that is to say, a faithful reproduction, of those data.

67.      In view of this, issuing a copy of the document that contains such data or an extract from a database does not always and in every case appear to be indispensable for achieving the objective pursued by the legislature.

68.      It is only where issuing a copy of that kind is indispensable for the purpose of ensuring that the personal data undergoing processing are fully intelligible that the data subject may, within the limits indicated in points 58 to 61 above, obtain portions of documents or, where appropriate, entire documents or extracts from databases.

69.      In that context, I note again that by providing, unlike Directive 95/46, for a genuine right to obtain a copy of data, the GDPR intended to strengthen the data subject’s position. (34) That marks a significant difference from the previous rules, which limited themselves to providing, in the second indent of Article 12(a) of the abovementioned directive, for the mere ‘communication to him [or her] in an intelligible form of the data undergoing processing’, thus leaving it to the Member States to determine the actual material form that the communication of personal data had to take, as long as it was intelligible. (35) The obligation now laid down in the first sentence of Article 15(3) of the GDPR on controllers to provide a ‘copy’ of the data means that the form that such communication must take, namely the form of a ‘copy’ of the data, is instead mandatory.

3.      Conclusion on the first three questions referred for a preliminary ruling

70.      In the light of all the foregoing, I believe that the first three questions submitted by the referring court for a preliminary ruling should be answered by stating that the first sentence of Article 15(3) of the GDPR should be interpreted as meaning that:

–        the concept of ‘copy’ referred to in that provision must be understood as a faithful reproduction in intelligible form of the personal data requested by the data subject, in material and permanent form, that enables the data subject effectively to exercise his or her right of access to his or her personal data in full knowledge of all his or her personal data that undergo processing – including any further data that might be generated as a result of the processing, if those also undergo processing – in order to be able to verify their accuracy and to enable him or her to satisfy himself or herself as to the fairness and lawfulness of the processing so as to be able, where appropriate, to exercise further rights conferred on him or her by the GDPR; the exact form of the copy is determined by the specific circumstances of each case and, in particular, the type of personal data in respect of which access is requested and the needs of the data subject;

–        that provision does not confer on the data subject a general right to obtain a partial or full copy of the document that contains his or her personal data or, if the personal data are processed in a database, an extract from that database;

–        that provision does not rule out, however, the data subject having to be provided with portions of documents, or entire documents or extracts from databases, if that were necessary to ensure that the personal data undergoing processing and in respect of which access is requested are fully intelligible.

B.      The fourth question referred for a preliminary ruling

71.      With the fourth question it has referred for a preliminary ruling, the referring court asks the Court whether the concept of ‘information’ in the third sentence of Article 15(3) of the GDPR refers only to the ‘personal data undergoing processing’ referred to in the first sentence of that paragraph or whether, in addition to those, it also includes the information referred to in Article 15(1)(a) to (h) (fourth question under (a)) or even other information such as, for example, metadata about data (fourth question under (b)).

72.      To answer that question, the term ‘information’ contained in the third sentence of Article 15(3) of the GDPR must be interpreted, applying the methodology that follows from the case-law referred to in point 25 above.

73.      In that respect, from a literal point of view, the term ‘information’ seems too general to clarify whether it refers exclusively to the personal data specified in the first sentence of Article 15(3) of the GDPR or whether it includes other types of information.

74.      From the point of view of the context, however, it should be noted that the abovementioned third sentence forms part of Article 15(3) of the GDPR, which concerns the controller’s obligation to provide, at the request of the data subject, a ‘copy of the personal data undergoing processing’. The structure of paragraph 3 therefore leads to the assumption that the term ‘information’ refers to the information that is the subject matter of the request to be fulfilled under the first sentence of the same paragraph and thus to the request to receive a copy of the personal data undergoing processing.

75.      That interpretation also seems to be in line with the objective of paragraph 3 itself, which is to determine, as follows from point 61 et seq. and in particular point 69 above, the form that the communication of personal data undergoing processing must take, namely, the form of the ‘copy’ of the data. In that respect, the third sentence of that paragraph is intended to regulate the specific case in which the request to obtain a copy of such data is made by electronic means.

76.      That said, it should also, in my view, be noted that the obligation of transparency resulting from Article 12(1) of the GDPR, referred to in points 54 and 55 above, which is aimed at ensuring that the data subject is enabled fully to understand the information sent to him or her, inter alia pursuant to Article 15 of the GDPR, taken in its entirety, imposes the obligation that, where a request for access as referred to in Article 15(1) of the GDPR is made by electronic means, the information referred to in points (a) to (h) also be provided in a commonly used electronic form that enables the data subject to acquaint himself or herself with it fully, easily and without difficulty. If the electronic form containing that information is not in common use, that could make acquainting oneself with that information extremely difficult or burdensome, which would fail to comply with the abovementioned obligation of transparency.

77.      Lastly, with regard specifically to question (b), it follows from the fact that the third sentence of Article 15(3) of the GDPR refers to the data subject’s ‘request’ that the concept of ‘information’ contained in that provision cannot go beyond the precise subject matter of that request, namely the copy of the personal data undergoing processing. It follows that the term ‘information’ used therein refers exclusively to such data and cannot include any information other than that and certainly no information additional to that referred to in Article 15(1)(a) to (h) of the GDPR. Otherwise, the scope of the right of access would in fact be extended, for which – as, moreover, previously noted in points 48 to 51 above – there is no basis in the GDPR.

78.      It follows from all the foregoing that, in my view, the answer to the fourth question referred should be that the concept of ‘information’ in the third sentence of Article 15(3) of the GDPR should be interpreted as referring exclusively to the ‘copy of personal data undergoing processing’ referred to in the first sentence of that paragraph.

IV.    Conclusion

79.      In the light of all the foregoing, I propose that the Court answer the questions referred for a preliminary ruling by the Bundesverwaltungsgericht (Federal Administrative Court, Austria) as follows:

The first sentence of Article 15(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that the concept of “copy” referred to in that provision must be understood as a faithful reproduction in intelligible form of the personal data requested by the data subject, in material and permanent form, that enables the data subject effectively to exercise his or her right of access to his or her personal data in full knowledge of all his or her personal data that undergo processing – including any further data that might be generated as a result of the processing, if those also undergo processing – in order to be able to verify their accuracy and to enable him or her to satisfy himself or herself as to the fairness and lawfulness of the processing so as to be able, where appropriate, to exercise further rights conferred on him or her by the GDPR; the exact form of the copy is determined by the specific circumstances of each case and, in particular, the type of personal data in respect of which access is requested and the needs of the data subject;

that provision does not confer on the data subject a general right to obtain a partial or full copy of the document that contains his or her personal data or, if the personal data are processed in a database, an extract from that database;

that provision does not rule out, however, the data subject having to be provided with portions of documents, or entire documents or extracts from databases, if that were necessary to ensure that the personal data undergoing processing and in respect of which access is requested are fully intelligible.

The concept of “information” in the third sentence of Article 15(3) of Regulation 2016/679

must be interpreted as referring exclusively to the “copy of personal data undergoing processing” referred to in the first sentence of that paragraph.

1      Original language: Italian.

2      OJ 2016 L 119, p. 1.

3      Judgment of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994).

4      See the references to Austrian and German doctrine and case-law in paragraphs 1 and 2 of the order for reference, respectively.

5      The Austrian Data Protection Authority, CRIF, the Italian and Czech Governments, and the European Commission lean, in essence, towards the restrictive interpretation, while the Austrian Government and Mr F.F. lean rather towards the broad interpretation of the provision.

6      See, inter alia, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija (C‑184/20, EU:C:2022:601, paragraph 121 and the case-law cited).

7      See, with reference to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), judgment of 9 March 2017, Manni (C‑398/15, EU:C:2017:197, paragraph 39 and the case-law cited).

8      See, inter alia, judgment of 1 August 2022, Navitours (C‑294/21, EU:C:2022:608, paragraph 25 and the case-law cited).

9      See the Treccani dictionary, which can be consulted on the website https://www.treccani.it

10      Without claiming completeness, I note, moreover, that the following language versions use the term corresponding to the Italian term: ‘cópia’ in Portuguese, ‘kopie’ in Dutch, ‘kopi’ in Danish, ‘kopiją’ in Lithuanian, ‘kopiju’ in Latvian and Croatian, ‘koopia’ in Estonian, ‘kopię’ in Polish, ‘kopii’ in Czech, ‘kopja’ in Maltese, ‘copie’ in Romanian, ‘kópiu’ in Slovak, ‘kopijo’ in Slovenian, and ‘kopia’ in Swedish.

11      See, with reference to Directive 95/46, judgment of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994, paragraph 34). In that regard, I note also that Case C‑579/21, Pankki S, which concerns the scope of the concept of ‘personal data’ under Article 4(1) of the GDPR is currently pending.

12      See judgment of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994, paragraphs 34 and 35).

13      See, inter alia, judgment of 9 March 2017, Manni (C‑398/15, EU:C:2017:197, paragraph 34 and the case-law cited).

14      Judgment of 17 July 2014, YS and Others (C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 38).

15      See judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes) (C‑175/20, EU:C:2022:124, paragraphs 18 and 34).

16      See judgment of 30 May 2013, Worten (C‑342/12, EU:C:2013:355, paragraph 19).

17      See judgments of 14 February 2019, Buivids (C‑345/17, EU:C:2019:122, paragraph 31), and of 11 December 2014, Ryneš (C‑212/13, EU:C:2014:2428, paragraph 22).

18      See judgment of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994, paragraphs 36 and 42).

19      See judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraph 60).

20      See recitals 10 and 11 of the GDPR.

21      It also follows from CRIF’s observations that the data subject was provided with his ‘credit score’, which was 100% (see, in particular, paragraph 8 of those observations). It is, however, for the referring court to determine in concrete terms precisely what information the data subject was provided with and whether the access granted to the data subject was in conformity with Article 15 of the GDPR.

22      See judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes) (C‑175/20, EU:C:2022:124, paragraph 35).

23      See, in that respect, my recent Opinion in Österreichische Post (Information regarding the recipients of personal data) (C‑154/21, EU:C:2022:452, point 14 and the case-law cited).

24      Notwithstanding any other provisions of the GDPR itself, for example Article 13 or Article 14 thereof.

25      See, in particular, Article 15(1)(h) of the GDPR, read in conjunction with Article 22 thereof. In that regard, see also Case C‑634/21, SCHUFA Holding and Others (Scoring), currently pending before the Court.

26      In that regard, see recital 58 of the GDPR, which states that ‘the principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used’.

27      See, to that effect, recital 59 of the GDPR and the case-law cited in points 64 and 65 below.

28      See judgment of 17 July 2014, YS and Others (C‑141/12 and C‑372/12, EU:C:2014:2081, paragraphs 57 and 60).

29      Access to documents is governed by Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43), while the processing of personal data by the institutions is governed by Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).

30      In that respect, see, with reference to Directive 95/46, judgment of 17 July 2014, YS and Others (C‑141/12 and C‑372/12, EU:C:2014:2081, paragraphs 46 and 47 in fine).

31      See, with reference to Directive 95/46, judgments of 17 July 2014, YS and Others (C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 44), and of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994, paragraph 57). See, in that respect, also my recent Opinion in Österreichische Post (Information regarding the recipients of personal data) (C‑154/21, EU:C:2022:452, points 26 and 28). The question whether the right of access to the data and, in particular, the right to receive a copy of one’s personal data provided for in the first sentence of Article 15(3) of the GDPR may be exercised also where the data subject pursues a legitimate purpose that is not, however, related to data protection, is the subject matter of the questions referred for a preliminary ruling in Case C‑307/22, FT (in relation to the examination of the existence of claims under medical liability law), and in Case C‑672/22, DKV (in relation to the examination of the validity of increases to the contributions to a private sickness insurance).

32      See, with reference to the corresponding provisions of Directive 95/46, judgments of 7 May 2009, Rijkeboer (C‑553/07, EU:C:2009:293, paragraphs 51 and 52); of 17 July 2014, YS and Others (C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 44); and of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994, paragraph 57).

33      See, to that effect, with reference to the corresponding provisions of Directive 95/46, judgment of 7 May 2009, Rijkeboer (C‑553/07, EU:C:2009:293, paragraph 52).

34      As part of its objective to strengthen and clarify the rights of data subjects. In this regard, see recital 11 of the GDPR.

35      See judgment of 17 July 2014, YS and Others (C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 57).

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.