- The ECJ states that Art. 15 para. 3 GDPR does not create an independent right to information, but regulates the form of the information already provided for in para. 1.
- “Copy” refers to personal data in documents; entire documents or extracts are only required if context is necessary for comprehensibility (e.g. derived data, free text fields).
The European Court of Justice ECJ on May 4, 2023 in Case C‑487/21 a judgment in the CRIF case. following a decision by the Austrian Data Protection Authority and a referral from the Federal Administrative Court of Austria.
The starting point was Art. 15 (3) GDPR:
(3) The responsible person shall provide a Copy of the personal data which are the subject of the processing. For any additional copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. If the data subject makes the request electronically, the following shall apply provide the information in a common electronic format, unless it specifies otherwise.
The ECJ was faced with the question of whether this provision only determines the form of the information or whether it grants a further right to information on the context of the processing. The ECJ answered this question in the negative. Also, the term “copy” does not refer to entire documents, but only to the personal data they may contain:
32 Therefore, Art. 15 GDPR cannot be interpreted as granting a right in its para. 3, first sentence, other than the one provided for in its para. 1. Moreover, as the European Commission has emphasized in its written explanations, the term refers to. “Copy” does not refer to a document as such, but to the personal data it contains, which must be complete. The copy must therefore contain all personal data that are the subject of processing.
This does not mean, however, that a claim for the release of a copy of documents is excluded – if further information than Context information are necessary for understanding, they are also covered by the right to information:
41 Indeed, in order to ensure that the information thus provided is easily comprehensible, as required by Article 12(1) in conjunction with recital 58 in the preamble to the GDPR, the reproduction of extracts from documents, or even of entire documents, or even of extracts from databases containing, inter alia, personal data which are the subject of the processing, may, as the Advocate General pointed out in points 57 and 58 of his Opinion, prove indispensable where the contextualization of the data processed is necessary in order to ensure their comprehensibility.
This is particularly true when it comes to derived data or information in Free text fields goes:
42 In particular, when personal data are generated from other data or when they are based on free fields, i.e., a missing indication from which information about the data subject emerges, the context in which these data are the subject of processing is essential so that the data subject can obtain transparent information and an intelligible presentation of these data.