CRIF GmbH, a business consulting agency, provides its clients with information on the creditworthiness of third parties.

On 20 December 2018, pursuant to Article 15 of the GDPR, an individual (FF) contacted CRIF requesting a copy of his personal data that CRIF was processing for one of its clients.

CRIF provided some of the requested information in an aggregated form that reproduced FF’s stored personal data, first, in a table broken down by name, date of birth, street, postal code and place, and second, in a statement summarising corporate functions and powers of representation. However, no other documents, such as emails or extracts from databases, were provided.

FF complained to the Austrian Data Protection Authority (ADPA), saying that the response to his request was incomplete and that the controller should have sent him a copy of all documents, including emails and database extracts, that contained his personal data.

The ADPA rejected FF’s complaint, finding that the controller had not infringed FF’s right of access to his personal data.

FF challenged the ADPA’s decision before the Austrian court, which has asked the CJEU questions on the scope of a data subject’s right under Article 15(3) of the GDPR according to which “the controller shall provide a copy of the personal data undergoing processing”. The first question seeks a determination as to the exact meaning of “copy” and the second question seeks clarification as to whether the data subject has the right to obtain a copy of the documents or of extracts from databases in which personal data is being processed or whether the right is limited to receiving a faithful reproduction of the original personal data processed only. In the latter case, the third question seeks to ascertain whether, depending on the type of data processed and in accordance with the principle of transparency, it might nonetheless be necessary in some cases to provide portions of text or entire documents as well.

The Advocate General has opined that the concept of “copy” in Article 15(3) must be understood as referring to a faithful reproduction in intelligible form of the personal data requested, in material and permanent form, that enables the data subject effectively to exercise their right of access to their personal data in full knowledge of all their personal data undergoing processing, including any further data that might be generated as a result of the processing (if that also undergoes processing), in order to be able to verify the accuracy of the personal data and to satisfy themself as to the fairness and lawfulness of the processing, such that they can, where appropriate, exercise their further rights under the GDPR. In the AG’s view, the exact form of the “copy” should be determined by the specific circumstances of each case, including the type of personal data in respect of which access is requested and the needs of the data subject.

The AG also said that Article 15(3) does not confer on the data subject a general right to obtain a partial or full copy of the document that contains his or her personal data or, if the personal data is processed in a database, an extract from that database. However, Article 15(3) does not rule out the data subject being provided with portions of documents or entire documents or extracts from databases if that is necessary to ensure that the personal data undergoing processing and in respect of which access is requested is fully intelligible.

The AG also said that the concept of “information” in the third sentence of Article 15(3) refers only to the “personal data undergoing processing” referred to in the first sentence of that Article. (Case C-487/21 FF v Österreichische Datenschutzbehörde EU:C:2022:1000 (Opinion of Advocate General) (15 December 2022) — to read the Opinion in full, click here).