On 4 May 2023, the Court of Justice of the European Union (CJEU) delivered a noteworthy judgment in Case C-487/21 F.F. v Österreichische Datenschutzbehörde. The judgment presents important clarifications regarding a person’s right to obtain a “copy” of their personal data under Article 15 of the GDPR.

The case involved an access request made by the applicant to a business consulting agency providing creditworthiness information on third parties, including the applicant. As part of his request, the applicant sought copies of the documents, such as emails and database extracts, containing his personal data. In response, the consulting agency provided a summary of his personal data by way of list, but not copies of the documents. The applicant lodged a complaint with the Austrian Data Protection Authority, the DSB, but the complaint was rejected. The applicant then appealed to an Austrian Court, which referred the case to the CJEU for clarification on the meaning of the term "copy" in the context of an access request.

Last week, the CJEU ruled that the right of access gives the data subject the right to a “faithful reproduction of his or her personal data” processed by a data controller. This right might also entail entire documents or extracts from documents or databases containing the data, if essential for the data subject to effectively exercise their rights under the GDPR. The Court also emphasised the need to balance the data subject's right to access their personal data with the rights and freedoms of others. Therefore, a controller may need to provide a full document or communication (or an important excerpt) when complying with access requests, subject to considering the protection of other third parties’ personal data.

In summary, as outlined in the CJEU’s press release, “the right to obtain a 'copy' of personal data under Article 15(3) of the GDPR means that the data subject must be provided with an accurate and understandable reproduction of all such data. This right includes the ability to obtain copies of document extracts or entire documents or extracts from databases containing such data if necessary to effectively exercise GDPR rights, while also considering the rights and freedoms of others.” The CJEU also highlighted that it is important to note “the term ‘copy’ does not relate to a document as such, but to the personal data which it contains and which must be complete. The copy must therefore contain all the personal data undergoing processing.”

The official press release can be found here, and the CJEU judgment is available here.