logo_klein
ECJ update on copy of data
ECJ update on copy of data

What does a personal data copy actually mean? Opinions differ on this. The ECJ has dealt with a request for a preliminary ruling from the Austrian Federal Administrative Court (BVwG).

Background

A natural person had reported the credit reference agency CRIF GmbH to the data protection authority. He had previously requested information in accordance with Art. 15 GDPR (including about email traffic between the person and the credit agency). The person was provided with a list of data in aggregated form. After that, the data protection authority was consulted and decided that the right to information had not been violated. The BVwG referred the case to the ECJ. This questions referred mainly concern the following points:

  • Is a copy the same as a photocopy (i.e. a copy of the data as it is)?
  • Does Art. 15 GDPR give rise to a legal entitlement to the disclosure of complete documents or copies thereof?
  • In the event that complete documents must be disclosed, the BVwG asks the ECJ about the scope of the right to disclosure.

The decision of the ECJ

It was ruled by the ECJ that the term "copy" is to be understood in the ordinary sense as a faithful reproduction or transcript. A general description of the data or a list of categories is not sufficient. The information transmitted must be precise, transparent, comprehensible and easily accessible so that the data subject can fully understand it. The right to a copy also includes extracts from documents or databases, especially if the contextualization of the data is necessary for understanding, such as when calculating a credit score based on the data subject's data. (para. 18 et seq.)

According to Art. 15 para. 4 GDPR, the rights and freedoms of the controller or other persons must be taken into account accordingly. Business secrets or data of other persons therefore do not have to be disclosed (para. 44 et seq.).

However, the ECJ also clarified that only personal data is relevant. The term "information" only refers to data that is also subject to the GDPR (para. 46 et seq.).

Significance for practice

The right to copy data extends very far. Data controllers are well advised not to restrict it too much. If a restriction is to be made for reasons of business secrets or other reasons, the consideration should be well documented so that it can be presented in the event of a dispute.

Link to the decision

The decision can be accessed via the following link: EuGH, C-487/21

Do you have further questions?

Would you like advice in the area of data protection law? Please contact our lawyers under office@geuer.at or by telephone on +43-1-4380072.

Scroll to Top