Copy or Not - Advocate General Delivers Opinion (Art. 15 (3) GDPR)

It has long been disputed how the right to be provided with a copy of personal data pursuant to Article 15 (3) sentence 1 of the GDPR is to be understood. In many cases, attempts are made to use this right to obtain copies of documents that would otherwise only be made available for a fee, e.g. bank statements or patient files, but there are also repeated disputes over the provision of copies of personal data in employment law disputes.

It is therefore not surprising that the question was finally referred to the ECJ by the Austrian Federal Administrative Court (Case C-487/21). Advocate General Giovanni Pitruzzella has now commented on this question in his opinion. Fortunately, this opinion is in favor of the responsible parties.

Background
According to Article 15 (1) of the GDPR, every data subject has the right to obtain confirmation from the controller as to whether or not personal data relating to him or her are being processed. If this is the case, further information must be provided with regard to this personal data. So far, so clear. Where things get interesting is in Article 15 (3) sentence 1 of the GDPR, according to which the controller must provide a free copy of the personal data undergoing processing. German courts have also already dealt with this question sufficiently (see our article of July 21, 2021). The dispute behind this is whether a copy of the entire document containing the personal data must be handed over or only the personal data themselves.

This question is by no means of a purely theoretical nature, since the surrender of copies of the documents, on the one hand, causes considerable effort on the part of the controller. For example, in labor disputes in particular, the handover of copies of all e-mails of the person concerned is increasingly demanded, since these would contain his or her personal data. On the other hand, the handover of copies of documents is in some cases subject to a charge in accordance with general terms and conditions or laws, e.g. patient files. Data subjects are now trying to obtain these copies free of charge through the claim under Article 15 (3) sentence 1 of the GDPR.

Opinion of the Advocate General
In his opinion, the Advocate General has clearly positioned himself on this issue. After first interpreting the terms 'copy', 'personal data' and 'processing', he states,

"that the 'copy of the personal data' must be a faithful reproduction of those data."

Accordingly, the controller must ensure that its compilation of personal data is complete and accurate. Not only the collected data must be taken into account, but also self-generated data, e.g. evaluations.

However, the Advocate General goes on to state significantly:

"However, in so far as that provision refers exclusively to the copy of personal data, it, first, cannot form the basis of a right to access information that cannot be classified as such and, second, does not – necessarily – grant the data subject the right to receive copies of documents or of other media containing personal data.”

Thus, at least the Advocate General has clearly positioned himself to the effect that data subjects do not have a fundamental right to obtain copies of documents from Article 15(3), first sentence of the GDPR. However, the Advocate General also emphasizes that there may be exceptions to this principle, e.g. if the disclosure is necessary in individual cases in order to make the disclosed data comprehensible. In such cases, it may also be necessary to provide complete documents or excerpts from a database.

In his opinion, the Advocate General also clarifies that, in his view, Article 15 (3) sentence 1 of the GDPR does not establish an independent right, but merely concretizes the right under Article 15 (1). In the end, this is consistent with his view that, in principle, no copies are to be surrendered.

Practice note
The Advocate General's Opinion finally brings clarity to a question that has been discussed for years and considerable relief for data controllers. However, care must still be taken to ensure that personal data is released in full. This can still lead to considerable effort, especially when processing in different systems. In this context, it should also always be checked whether the surrender can be partially refused in view of Section 34 (1) BDSG.

Nevertheless, data controllers should primarily wait for the ECJ's decision on the matter itself before possibly converting existing processes. Although the ECJ sometimes follows the Advocate General's opinion, this is by no means certain. In the present case, those responsible can only hope that the ECJ will also find the opinion convincing. Until then, responsible parties should weigh up which documents they will hand over to the persons concerned. We will be happy to support you in this.

The ECJ recently ruled on questions regarding the scope of the obligation to disclose the identity of the recipients of personal data under data protection law. We will inform you about this shortly.