GDPR: Meaning of the right to obtain a ‘copy’ of personal data

In a recent judgment in Case C-487/21, the Court of Justice of the European Union shed light on the interpretation and scope of the right to obtain copies of personal data under the General Data Protection Regulation (GDPR). The ruling emphasizes the importance of providing data subjects with faithful and intelligible reproductions of their personal data, including extracts from documents or entire documents, if necessary, to effectively exercise their GDPR rights.

An individual requested controller access to his personal data, along with copies of documents, such as emails and database extracts, in a standard technical format. In response, the data controller provided the applicant with a summary of his personal data undergoing processing, which the applicant found insufficient. Consequently, the applicant filed a complaint which was unfortunately rejected by the Austrian Data Protection Authority, thus, the case was brought before the Austrian Federal Administrative Court (Bundesverwaltungsgericht) seeking clarification on the extent of the obligation to provide a 'copy' of personal data under Article 15(3) of the GDPR and the concept of 'information' mentioned in the same provision.

The Court of Justice clarified that the right to obtain a 'copy' of personal data means that data subjects must receive a faithful and intelligible reproduction of all their data. This includes the right to obtain copies of extracts from documents or even entire documents and extracts from databases containing the requested data. This provision ensures that data subjects can effectively exercise their rights under the GDPR, while taking into account the rights and freedoms of others. The Court further explained that the term 'copy' refers to the personal data contained within a document rather than the document itself. To comply with the GDPR, the copy provided by the controller must be complete, accurate, and enable the data subject to ensure the correctness and lawful processing of their personal data.

Importantly, the Court of Justice highlighted that the right to access personal data aims to provide data subjects with transparent and intelligible information. Therefore, the reproduction of extracts or entire documents may be essential, especially when personal data are derived from other data sources or when there are empty fields. Contextual information plays a vital role in clearly presenting personal data. The Court also emphasized the need to strike a balance between the data subject's right to access complete personal data and the rights and freedoms of others. According to the judgment of the court, wherever possible, means of communicating personal data that do not infringe on the rights or freedoms of others should be chosen, but this should not result in the complete refusal to fulfil the data subject's request.

The judgment clarifies the content and scope of the data subject's right to obtain copies of their personal data, but data controllers will need to exercise increased caution when responding to copy requests, as they must provide faithful and intelligible reproductions of all relevant data, including extracts from documents or entire documents if necessary, while also considering the rights and freedoms of others.