Important Decision Impacting How Companies Must Provide Personal Data Requested By Data Subjects Under Their Access Rights

• Jurisdiction: European Union
• Law Firm: Preiskel & Co
• Subject Matter: Privacy, Data Protection
• Author: Jose Saras and Xavier Prida
• Published date: 31 January 2023

Giovanni Pitruzzella, Advocate General (AG) recently issued an opinion on what is within scope of the right conferred under Article 15(3) of the EU GDPR to obtain a copy of personal data being processed. The clarifying opinion relates to Case C-487/21 regarding questions referred for a preliminary ruling as lodged by the Austrian Federal Administrative Court.

The AG's opinion specifically centred on the extent of information available to data subjects by way of the rights of access to personal data and to receive an intelligible copy of said data as follows:

• The concept of "copy" referred to in Article 15(3) of the EU GDPR must be construed as including an authentic and clear reproduction of the personal data requested by the data subject, in material and permanent form.
• Such copy should in turn allow data subjects to exercise their right of access and provide full visibility of all their personal data undergoing processing, which includes any data that might be produced as a result of the processing, in order to verify its accuracy and allow them to be satisfied as to the fairness and lawfulness of the processing and, where relevant, to be able to exercise other rights available to them in the EU GDPR.
• The precise form of the copy accordingly depends on the particular circumstances of each case and, specifically, the nature of personal data in respect of which access is requested and the requirements of the data subject.
• Article 15(3) of the EU GDPR should therefore not categorically rule out a data subject's right to be provided with sections of documents, or complete documents or excerpts from databases, if that was essential to guarantee...