The right to obtain a “copy” of one’s personal data conferred by the General Data Protection Regulation (GDPR) implies obtaining a “faithful and intelligible” reproduction of all one’s data, the Court of Justice of the EU (CJEU) ruled in a judgment delivered on Thursday 4 May (C-487/21).
An individual had asked an Austrian agency to provide him with all his personal data, as well as all e-mails and database extracts relating to him, in “a standard technical format”. However, the Agency had only sent the applicant in the main proceedings, in summary form, the list of his personal data undergoing processing.
After an appeal by the individual was rejected by the Austrian data protection authority, the Federal Administrative Court asked the CJEU whether the obligation to provide a “copy” of personal data to the individual also implies the obligation to transmit the documents in which they are reproduced.
For the Court, the GDPR does require the provision of a “true and intelligible reproduction” of all such data, including “copies of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by the GDPR”.
In fact, the GDPR requires that the information provided allows the data subject to ensure that his or her data is accurate and that it is processed lawfully. It also has the right to obtain them in an intelligible form. However, when data is the result of other data or form fields left blank, or when context is needed to make it intelligible, the reproduction of documents and databases may be necessary.
However, the CJEU stresses that the way in which such personal data is communicated must, as far as possible, avoid infringing the rights or freedoms of others.
To see the judgment (in French): https://aeur.eu/f/6p5 (Original version in French by Hélène Seynaeve)