Big Privacy Judgment Day: Important Decisions On Right To Compensation And Right Of Access

• Jurisdiction: European Union
• Law Firm: Loyens & Loeff
• Subject Matter: Privacy, Data Protection
• Author: Kim Lucassen and Nina Orli&#263
• Published date: 18 May 2023

On 4 May 2023, the Court of Justice of the European Union has delivered two groundbreaking judgments. Case C-487/21 F.F. v 'sterreichische Datenschutzbeh'rde and Case C-300/21 UI v 'sterreichische Post AG. Both judgments present a few important clarifications regarding (1) the data subject's right to obtain a copy of personal data (Case C-487/21) and (2) the right to compensation for an infringement of the GDPR (Case C-300/21). This blogpost outlines the key points of both cases and explains their relevance.

Case C-487/21 F.F. v 'sterreichische Datenschutzbeh'rde

In this case, the applicant submitted an access request with CRIF GmbH, a business consulting agency that provides information on the creditworthiness of third parties. In this context, the applicant also requested copies of the documents, such as emails and database extracts, containing his personal data. Following that request, CRIF provided the applicant with information about his personal data in a summary form but did not provide copies of the documents in which his personal data were included. Subsequently, the applicant filed a complaint with the Austrian Data Protection Authority (DPA) in which he claimed that the response to his request was incomplete and that CRIF should also have sent him a copy of all the documents that contained his personal data. As the complaint was rejected, the applicant brought an action against the DPA's decision before the Austrian court. Therefore, that Austrian court sought clarification as to the exact meaning of the concept of a 'copy' of the personal data in the context of an access request.

In this judgment the Court finds that the right of access gives the data subject the right to obtain a faithful reproduction of his or her personal data, understood in a broad sense, processed by a data controller. The Court emphasizes that the term "copy" generally does not relate to a copy of an actual document as such, but only to the personal data processed. However, the Court also states that pursuant to article 15(3) GDPR, the data subject must be given a faithful reproduction or transcription of all that data. In some cases, this may entail the right to obtain copies from extracts of documents, or even entire documents, or extracts from databases, containing his persona data, if this is essential to enable the data subject to effectively exercise his rights under the GDPR.

Further, the Court considers that if there is a conflict between a data subject's right...