- Art. 15 para. 3 GDPR does not require the release of individual copies of documents, but a copy of the processed personal data.
- “Copy” is to be understood as a meaningfully structured summary, not as a copy of all the documents concerned.
- The obligation to provide a copy specifies and supplements Art. 15 (1) and determines the manner in which information is provided.
- A true copy of a document is only required if it is necessary to verify the lawfulness of the processing.
The Hessian Data Protection Commissioner has published his 47th activity report published. Particularly noteworthy are his comments on the scope of the right to information pursuant to Art. 15 GDPR.
First, he expresses his opinion on the subject of the right to information, as follows:
As a rule, Art. 15 (3) GDPR does not contain a claim to the issuance of individual copies – e.g., in the sense of a photocopy of certain documents: The obligation to provide a copy is not to be equated with a general right of access to information or a right to inspect files
This view is also correct under the Swiss DPA. Here, too, the right to information is directed at personal data, not at documents containing personal data.
The Hessian Commissioner justifies his opinion as follows:
I am of the opinion that Art. 15 (3) and (4) of the GDPR is not a right detached from Art. 15 (1) of the GDPR. Controllers must therefore comply with the obligation contained in Art. 15(3) of the GDPR even without a corresponding notice to the data subjects. This is supported by the wording of Article 15 (3) of the GDPR. Accordingly, data subjects must be provided with a copy of the personal data that is the subject of the processing. In this respect, Article 15 (3) of the GDPR substantiates the wording of Article 15 (1) (b) of the GDPR: Data subjects must not only be shown the categories of personal data that are processed, but their specific personal data must be communicated. Art. 15(3) of the GDPR thus specifies the provision contained in Art. 15(1)(b) of the GDPR on the scope of the right to information and determines the manner (copy) of providing information.
Further, by “copy” it is not meant that each individual personal data is to be provided:
I understand the copy term of Art. 15 (3) DS-GVO in the sense of a meaningfully structured summary. The persons concerned must therefore be not be provided with copies of all documents concerning them.
Article 15 (3) of the GDPR merely regulates the way in which information is provided and has a serving function compared to Article 15 (1) of the GDPR: the data subjects are once again – by providing a structured summary of their personal data – provided with the information they require. made known in contextwhich personal data is processed by the data controller.
In the case of employee data, the Hessian Commissioner considers the following to be sufficient:
-
Provision of a Profile excerpt of data subjects in the case of use of a personnel information system by responsible persons
-
List of documents or file numbers stored for a person when using a document management or filing system
A right to a copy of individual documents may exist if this is necessary to verify the lawfulness of the data processing. As a rule, however, it should be sufficient to inform the data subject of the data contained in the document. The copy of a document or an e‑mail would usually not have to be provided.It is then permissible in the employment relationship to demand that the persons concerned specify their request for information.