BVwG - W211 2222613-2/12E

BVwG - W211 2222613-2/12E (request for preliminary ruling under Article 267 TFEU)
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 15(3) GDPR Article 267 TFEU
Decided:	09.08.2021
Published:
Parties:	1. unknown (complainant before the Austrian Data Protection Autority) 2. CRIF GmbH (Austrian credit reference agency, respondent before the Austrian Data Protection Autority) 3. Datenschutzbehörde - DSB (Austrian Data Protection Autority)
National Case Number/Name:	W211 2222613-2/12E (request for preliminary ruling under Article 267 TFEU)
European Case Law Identifier:
Appeal from:	DSB DSB-D124.059/0005-DSB/2019
Appeal to:
Original Language(s):	German
Original Source:	dataprotect.at (in German)
Initial Contributor:	n/a

The Austrian Federal Administrative Court requested the CJEU's preliminary ruling on the interpretation of Article 15(3) GDPR. In particular, it asked for clarification on the meaning and extent of "a copy of the personal data undergoing processing" and "information".

English Summary

Facts

A data subject (the complainant) sent an access request to an Austrian credit reference agency (the respondent), requesting (i.a.) a copy of their personal data undergoing processing pursuant to Article 15(3) in a commonly used electronic format.

The respondent only provided a table that contained the personal data (name, date of birth, address data business functions of the data subject) in an aggregated form but refused to provide an actual copy of the data undergoing processing, such as database print-outs or email correspondence regarding the complainant. The respondent argued that Article 15(3) GDPR does not entitle a data subject to receive a copy of the data in the sense of a facsimile of the data. Furthermore, the disclosure of a copy would also violate the respondent's business secrets, since a copy of data from a relational database (such as the respondent's identity and creditworthiness database) would inevitably also reproduce the logical-mathematical links of the individual data records.

The complainant argued that Article 15(3) GDPR entitles them to a copy of the data in the very form that these data are undergoing processing. A controller has no right to limit the right of access to a modified aggregation of the relevant data.

The Austrian Data Protection (Datenschutzbehörde - DSB) followed the respondents argument and rejected the complainant's claim. It deemed the data and information provided by the respondent to be sufficient.

The complainant consequently filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG).

Holding

The BVwG stayed the procedure and requested the CJEU's preliminary ruling under Article 267 TFEU on the following questions:

1. Is the term "copy" in Article 15(3) GDPR to be interpreted as meaning a photocopy or facsimile or an electronic copy of (electronic) data, or does the term also cover a "transcript", un "double" ("duplicata") or a "transcript", as understood in German, French and English dictionaries?

2. Must the first sentence of Article 15(3) of the GDPR, according to which "the controller shall provide a copy of the personal data undergoing processing", be interpreted as implying a general legal right of a data subject to obtain a copy of - also - all documents relating to him or her or the provision of a copy of an extract from the database where the personal data are processed in such a database, or does this mean that the data subject has a legal right - only - to a faithful reproduction of the personal data to be provided with information pursuant to Article 15(1) of the GDPR?

3. In the event that the answer to question 2 is that the data subject only has a legal right to a faithful reproduction of the personal data to be provided pursuant to Article 15(1) GDPR: must Article 15(3) first sentence of the GDPR be interpreted as meaning that, due to the nature of the data processed (e.g. with regard to the diagnoses or examination results referred to in recital 63 or documents in connection with an examination within the meaning of the judgment of the CJEU of 20.12.2017, C-434/16) and the transparency requirement in Article 12(1) GDPR it may nevertheless be necessary in individual cases to also make text passages or entire documents available to the data subject?

4. Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as meaning only the "personal data undergoing processing" referred to in the first sentence of Article 15(3) GDPR?

a. If the answer to question 4 is in the negative: Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as including, in addition, the information referred to in Article 15(1)(a) to (h) of the GDPR?

b. If question 4.a. is also answered in the negative: Is the concept of "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the request is made electronically, "unless otherwise requested by the data subject", to be interpreted as referring to the "personal data undergoing processing", the information referred to in Article 15(1)(a) to (h) GDPR and information going beyond these information, such as for example associated metadata?

Comment

1) Please note that this decision has not been officially published. The author of this summary has only been provided with a PDF copy of the BVwG's request under Article 267 TFEU, which was partially of poor visual quality. Therefore the machine translation below might be incomplete or faulty.

2) The procedure before the DSB and the BVwG also concerned other GDPR violations by the respondent. Regarding these issues, the BVwG issued a separate decision (see here).

3) The CJEU has already assigned a case number: C-487/21 (see here and here).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Mailing Address:
Erdbergstrasse 192 - 196
BVwG1030 	Vienna
Tel: +43 1 60149 -O
Federal Administrative Court	Fax: + 43 1 711 23-889 15 41
Republic of Austria	E-mail: einlaufstelle@bvwg.gv.at
www.bvwg.gv.at
Business Number (GZ):
W211 2222613-2/12E
(please indicate with all entries)
Decision
The Federal Administrative Court decides by the judge Mag. a Barbara SIMMA LL.M. as chairperson and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as associate judge on the appeal of XXXX against the notice of the data protection authority of
11.09.2019, DSB-D124.059/0005-DSB/2019, regarding the provision of a copy of the personal data processed in the context of a request for information pursuant to Art 15(3) GDPR in closed session:
The following questions are referred to the Court of Justice of the European Union for  a preliminary ruling under Article 267 TFEU:

(1) Is the term 'copy' in Article 15(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, OJ 2016 L 119/1, p. 1 ('the GDPR') to be interpreted as meaning a photocopy or facsimile or an electronic copy of an (electronic) datum, or does the term also cover a 'transcript', a 'double' ('dup/icata') or a 'transcript', as understood in German, French and English dictionaries?

2) Must the first sentence of Article 15(3) of the GDPR, according to which 'the controller shall provide a copy of the personal data undergoing processing', be interpreted as implying a general legal right of a data subject to obtain a copy of - also - all documents relating to him or her?
 
in which personal data of the data subject are processed, or to the provision of a copy of an extract from the database where the personal data are processed in such a database, or does this mean that the data subject has a legal right - only - to  a faithful reproduction of the personal data to be provided with information pursuant to  Article 15(1) of the GDPR?

(3) In the event that the answer to question 2 is that the data subject only has a legal right to a faithful reproduction of the personal data to be provided pursuant to  Art. 15(1) of the GDPR, Art. 15(3) first sentence of the GDPR must be interpreted as meaning that, due to the nature of the data processed (e.g. with regard to the diagnoses, examination results or also documents referred to in recital 63), it is not possible to provide the data subject with the original data. 3, first sentence, of the GDPR to the effect that, due to the nature of the data processed (for example, in relation to the  diagnoses, examination results, findings or also documents in connection with an examination within the meaning of the judgment of the Court of Justice of the European Union of 20 December 2017, C-434/16 , and the transparency requirement in Article 12(1) of the GDPR), it may nevertheless be necessary in individual cases to  also make text passages or entire documents available to the data subject?

(3) Is the term 'information' which, under the third sentence of Article 15(3) of the GDPR, must be provided to the data subject 'in a commonly used electronic format' where the data subject makes the request electronically 'unless he indicates otherwise ' to be interpreted as meaning only the 'personal data undergoing processing' referred to in the first sentence of Article 15(3)?

a.If the answer to question 4 is in the negative: Is the term 'information' which, under the third sentence of Article 15(3) of the GDPR, must be provided to the data subject 'in a commonly used electronic format' where the data subject makes the request electronically 'unless he indicates otherwise' to be interpreted as meaning, in addition, the information referred to in Article 15(1)(a) to (h) of the GDPR?

b.If question 4.a. is also answered in the negative: Is the concept of 'information' which, under the third sentence of Article 15(3) of the GDPR, must be provided to the data subject 'in a commonly used electronic format' where the request is made electronically, 'unless the data subject indicates otherwise', to be interpreted as referring to the 'personal data which are the subject of the request' of the processing' and, in addition to the information referred to in Article 15(1)(a) to (h) of the GDPR, for example, associated metadata?
Substantiation:  


I. Facts:
By letter of 20.12.2018, the complainant requested a credit reference agency to provide (among other things) information on personal data pursuant to Art 15 GDPR and further, to the extent relevant here, to send him a copy of the data processed about him in a standard technical format.
The credit reference agency partly provided the requested information in an aggregated form, reproducing the data stored on the complainant's person, on the one hand, in a table broken down by name, date of birth, street, postcode and town and, on the other hand, in an overview concerning business functions and powers of representation. No further documents, such as e-mails or database print-outs, were transmitted.  
Il. Arguments of the parties:  
The complainant submits that "copy of the data" means, for example, e-mails and database extracts, including any free text fields, which contain personal data. The claim for a copy of the data existed independently of the
Right to information on the content of the data processed, whereby processing of the copy of the data is not permitted, except in the cases of Art. 15 (4). On earlier
case law of the then Data Protection Commission, which ruled that the data should be disclosed as
copy, it should be noted that the legal situation has changed with the GDPR. In Austria, the Supreme Court (hereinafter "OGH") had already stated in its decision of 17 December 2020 on the new legal situation under the GDPR that, for example, the production of copies of medical records is a case of application of Article 15(3) of the GDPR (see OGH, 17 December 2020, ZI- 6 Ob 138/20t). The Federal Administrative Court had also stated in a decision of 24.05.2019 that duplicates of  bank statements would fall under the right to copies under Art 15(3) GDPR (Zl W258  
2205602-1).
 
The respondent - now the party involved in the proceedings before the Federal Administrative Court - argues that the handover of the copy of the data must in principle be denied and that in the present case no added value for the complainant can be discerned. All information and data would result from the request for information and the information; beyond that, no further data would be stored. The disclosure of a copy would also violate the respondent's business secrets, since a copy of data from the relational database would inevitably also reproduce the logical-mathematical links of the individual data records.  
The data protection authority submits that neither the legislator nor the recitals nor the literature assume that the complainant  would be entitled to a copy in the form of a facsimile. It rather assumes that, in principle, the right of access to one's own data under data protection law is an accompanying procedural right to verify whether data are processed in conformity with the law. In this sense, the European Court of Justice had already stated that the right of access serves to prepare the correction, deletion or blocking of data (see Rijkebeer, and Y.S. and  Others, C-141/12 and C-372/12, ECLl:EU:C:2014:2081). Accordingly, irrespective of what could be claimed in the right of access, the complainant's interest was thus normatively limited. It was also apparent from this that a facsimile was not the subject of the right of access. With  reference to Recital 63 of the GDPR and the judgment of the European Court of Justice of 14 July 2014, [YS and others], C-141/12 and C-372/12,  the data protection authority had already stated that no claim to the surrender of a copy of documents containing personal data of an information seeker could be derived from Article 15(3) of the GDPR. Article 15(3) of the GDPR only provides for the right to receive a "copy of the personal data which  are the subject of the processing". On the basis of these considerations, the surrender of copies of documents in the form of entire facsimiles could not be requested on the basis of Article 15(3) of the GDPR, as this could not be inferred from the wording of the provision. The Directive 2011/24/EU also speaks against such a surrender of entire documents: its Article 2 lit c refers to Directive 95/46/EC (now the GDPR) and leaves it unaffected. Art 4(1)(f) and Art 5(d) of Directive 2011/24/EU expressly lay down a right to receive a copy of "the patient's file" - thus a right to receive entire copies of documents.  If, in the light of this provision, Article 15(3) of the GDPR were to be interpreted as having a content aimed at the disclosure of entire documents, the provisions of other legal instruments,  such as Directive 2011/24/EU, would be rendered meaningless. Therefore, the legal opinion of the
 
The applicant claims that the Court should not follow the reasoning of the Oberster Gerichtshof in its judgment in Case No 6 Ob 138/20t, because the latter completely disregarded the abovementioned directive in its decision.
III. previous procedure:
Following a request for information and an initial partial provision of information by the credit reference agency, the complainant lodged a complaint with the data protection authority on 16.01.2019 on the grounds of inadequate response to the request for information, alleging, inter alia, that he had not been provided with a copy of the data.
After a written procedure, the data protection authority issued a decision on 11.09.2019 rejecting - among others - the complaint for breach of the right of access.  
The complainant filed an appeal against the decision with the Federal Administrative Court.
The Federal Administrative Court has to decide on the appeal against the decision of the data protection authority of 11.09.2019:
In its partial ruling of 9 August 2021, the Federal Administrative Court ruled on the objections regarding the provision of information on the origin of the data, the storage period and the processing purposes, as well as regarding the alleged violation of information obligations pursuant to Article 14 of the GDPR, regarding the alleged violation of the right to confidentiality pursuant to Section 1 of the GDPR, and regarding the alleged violation of the data minimisation obligation pursuant to Article 5 of the GDPR and the data protection obligations pursuant to Article 25 of the GDPR.
The Federal Administrative Court decides to refer the appeal to the Court of Justice of the European Union for a ruling on substantial questions of Union law with regard to the objection concerning Article 15(3) of the GDPR.
IV. Applicable Union law:
GDPR:
Article 4
Definitions
For the purposes of this Regulation:
l.'personal data' means any information relating to an identified or identifiable natural person (hereinafter 'data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;  
Article 12
Transparent information, communication and modalities for the exercise of the data subject's rights
(1)	The controller shall take appropriate measures to provide the data subject with all the
information referred to in Articles 13 and 14 and any communication referred to in Articles 15 to 22 and Article 34 relating to processing shall be provided in a precise, transparent, comprehensible and easily accessible form, using clear and plain language, in particular for information specifically addressed to children. The information shall be provided in writing or in another form, including, where appropriate, by electronic means. If requested by the data subject, the information may be provided orally, provided that the identity of the data subject has been established in another form.
(2)	The controller shall facilitate the exercise by the data subject of his or her rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller may
The data controller may refuse to act on the data subject's request to exercise his or her rights under Articles 15 to 22 only if he or she establishes that he or she is not in a position to identify the data subject.
(3)	The controller shall provide the data subject with information on the measures taken upon request in accordance with Articles 15 to 22 without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months if necessary taking into account the complexity and the number of requests. The controller shall inform the data subject of any extension of the time limit, together with the reasons for the delay, within one month of receipt of the request. Where the data subject makes the request electronically, he or she shall be informed by electronic means where possible, unless he or she indicates otherwise.
(4)	If the controller does not act on the request of the data subject, he shall inform the data subject without delay and at the latest within one  month of receipt of the request of the reasons therefor and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.  
(5)	Information pursuant to Articles 13 and 14 and any notices and measures  pursuant to Articles 15 to 22 and Article 34 shall be provided free of charge In the case of manifestly unfounded or, in particular in the case of frequent repetition,  excessive requests by a data subject, the controller may either
 (a) charge a reasonable fee which takes into account the administrative costs of informing or notifying or implementing the requested measure; or
(b) refuse to act on the application.
The responsible person must provide evidence of the manifestly unfounded or excessive nature of the request.
(6)	Without prejudice to Article 11, where the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21, he may request additional information necessary to confirm the identity of the data subject.  
(7)	The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give a meaningful overview of the intended processing in an easily perceivable, intelligible and clearly comprehensible form. If the pictorial symbols are presented in electronic form, they shall be machine-readable.  
(8)	The Commission shall be empowered to adopt delegated acts in accordance with Article 92 concerning the definition of the information to be represented by graphic symbols and the procedures for the provision of standardised graphic symbols.  
Article 15
Right of access of the data subject
(1. The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed; where this is the case,  
 
 8-
he/she shall have the right to obtain access to such personal data and to obtain the following information:
a)	the purposes of processing;
b)	the categories of personal data processed;  
c)	the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations;
d)	if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
e)	the existence of a right to obtain the rectification or erasure of personal data concerning him or her, or the restriction of processing by the controller, or a right to object to such processing;  
f)	the existence of a right of appeal to a supervisory authority;  
g)	if the personal data are not collected from the data subject, any available information on the origin of the data;
h)	the existence of automated decision-making, including professional/ing, pursuant to Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.  
(2)	Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards referred to in  Article 46 in relation to the transfer.
(3)	The controller shall provide a copy of the personal data undergoing  processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless the data subject indicates otherwise.
- 9 -
(4. The right to receive a copy under paragraph 3 shall not infringe the rights and freedoms of others.
Do not interfere with persons.
V.	On the right to present:
The Federal Administrative Court is a court within the meaning of Art 267 TFEU.
VI.	Reasons for the questions referred:
1.	On the question of what exactly is meant by a "copy of the personal data which are the subject of the processing" in Art 15(3) GDPR, there are different doctrinal opinions in Austria and Germany:
1.1 For a restrictive view: right to copy as a more detailed specification of the right of access; no right to documents or similar:
According to Paal in Paal/Pauly [eds.], Datenschutz-Grundverordnung, Bundesdatenschutzgesetz (DS-GVO/BDSG 3), C.H. Beck, 2021, Art 15 RZ 33f, the term copy in para. 3 refers to the information to be provided in accordance with para. 1 with regard to the personal data, so that the right to copy can in no way go beyond the right to information regulated in para. 1 in its substantive scope. The purpose of Article 15 is to enable the data subjects to verify the lawfulness of the data processing, and this reading is underlined by recital 63, first sentence. For this purpose, it was sufficient for the data subject to receive a copy of the information referred to in paragraph 1(a) to (h). Further information is not necessary. For the companies concerned,  a view that went beyond this would mean increased financial, practical and legal expense. In the case of an extensive interpretation, a balancing with the rights and freedoms of third parties (para. 4) would not be possible. However, the need for such a balancing is (indirectly) made clear by recital 63.
Jahnel states in the commentary on the GDPR Jan Sramek Verlag, 2021, Art 15, RZ 37f, 42f, that the systematics of Art 15(3) raises, among others, the question whether the scope of the right under Art 15(3) goes so far as to grant the data subject a right to a copy of all documents stored with the controller? According to the Duden, a copy means a "transcript, copy or other reproduction true to the original". According to Article 15(3), a copy of the data processed must be provided, and not a copy of the documents in which the data are used. Therefore, this phrase was to be understood as the right to a faithful representation of those data that were
- 10 -
are the subject of the processing. In order to meet the requirements of "faithfulness to the original", the data actually processed would have to be reproduced from the concrete data processing and thus copied and provided with information. The purpose of this arrangement could then be seen in the assurance of data identity when providing information, and thus in the correctness of the data information with regard to the concretely processed data. This is fulfilled if the controller exports the processed data categories together with their concrete content concerning the information seeker directly from the data processing, i.e. "copies" them in this sense. Interpreted in this way, the first sentence of Article 15(3) is to be understood as a more detailed specification of the general right to information on personal data in Article 15(1), which only lays down the basic right to information, but does not contain any information on the form and content of the provision of information.
Article 15(4) states that the right to receive a copy "in accordance with paragraph 3" must not affect the rights and freedoms of other persons. At first glance, this explicit reference to the right to a copy in para. 3 would seem to contradict the system developed so far, because according to the wording, it only refers to the right to a copy and not to the right of access to the content pursuant to Art 15 para. 1. This contradiction would be resolved, however, if one were to regard the right to copy as a more detailed provision regarding the manner in which information on personal data of the data subject was to be provided pursuant to Art. 15(1). In that case, the obligation to balance the interests of the data subject would apply to the entire provision of information. This view is also underlined by recital 63. It is true that this recital does not contain any indications as to the interpretation of the right to a copy pursuant to Article 15 (1).
3 However, it clearly expresses two things: first, a statement of the purpose of the right of access, namely 'in order to be aware of the processing and its
to be able to verify lawfulness". Thus, the purpose of Article 15 is to provide the data subject with sufficient information on the specific processing in order to be able to exercise his or her rights concerned, and not to provide him or her with duplicates of all the documents of the controller(s) containing his or her data. Furthermore, the right of access should "not prejudice the rights and freedoms of other persons l.... ]". It can be concluded from this that the European legislator wanted the balancing of interests under Article 15(4) to apply to the entire right of access, i.e. both to the right of access to the content under Article 15(1) and to its more detailed specification in the form of the right to a copy under Article 15(3).
 11 -
1.2 In favour of an extensive view:  
Dix in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht, DSGVO mit BDSG, Nomos
Verlagsgesellschaft, 2019, Art 15, para. 28, 33, argues that the GDPR for the first time grants the data subject a right to a copy of the data concerning him or her which are the subject of the processing. This right to a copy of data significantly strengthens the position of the data subject. The right to a copy of data is a specific form of access and not a separate obligation to surrender. It related to the information to be provided under paragraph 1 on the data processed concerning him or her. However, the right to copy data was not identical to the right to information; the copy could not replace the information, if only because  the copied data set often had to be supplemented by explanatory information in order to be comprehensible to the data subject. According to Article 12(1), the controller is obliged to ensure comprehensibility - if necessary   also by answering queries. The right to copy data according to para. 3 sentence 1 refers to the data in the form in which they are available to the person responsible (for example, in principle also genetic raw data of patients or test persons). The data controller is not obliged to  prepare the data in a specific form so that the data subject can process it further.
 The only exception is in the case of an electronic request for a copy of the data.  
If the controller provided the data subject with a copy of his/her data, this should not affect the rights and freedoms of other persons. The rights and freedoms of third parties could be prejudiced by the fact that the data of the data subject are
person would be processed together with the data of third parties (for example in the form of
paper lists). However, as a general rule, this does not justify a complete refusal to provide the data subject with a copy. Rather, in the case of conventional (analogue) data processing, the controller must blacken the data sheets for the provision of the copy. In the case of automated data processing, the production of a partial electronic copy is unproblematic in any case if it does not involve data with a double or multiple personal reference.  
Haidinger, in Knyrim [ed.], Der DatKomm Praxiskommentar zum Datenschutzrecht, DSGVO und DSG, Manz Verlag, 2021, Art 15 DSGVO, RZ 35, takes the view that the data subject is entitled to a copy of the data that are the subject of the processing, over and above the information as to which data about him or her are actually processed. A
the right to obtain a copy of the data from the (former Austrian)
Data Protection Commission has so far been explicitly denied. With copies of the data, E-
CO
 12-
This refers to e-mails, database excerpts, etc., which can be quite risky for the person responsible with regard to free text fields in databases. The right to data copy  stands independently next to the right to information about the content of the processed data.  The transmission of the data copy would cover both claims if the data were accessible to the data subject from the  copy in accordance with the transparency requirement, i.e. in particular if explanations were attached. Subject to Article 15(4), the data copy itself may not be processed because otherwise the content would be altered.
Ehmann in Ehmann/Selmayr [eds.], Datenschutz-Grundverordnung (DS-GV02) C.H. Beck, 2018, Art 15, does not address the scope or the nature of the copy, but says with regard to para. 3 sentence  3 of Art 15 GDPR that this refers to the fact that "information" is to be provided and not only the personal data, which does not constitute an inaccuracy in the  wording. Paragraph 3, sentences 1 and 2 correctly speak of a "copy of the personal data, as only these can be the subject of a copy by the controller. Paragraph 3 sentence 3, on the other hand, uses the term "information" to also specify the form in which the associated metadata are to be made available in addition to the "actual" personal data.
2.	Similarly, Austrian and German courts come to  different interpretations on this issue:
2.1 In favour of restrictive access:
The (Austrian) Federal Administrative Court ruled in its decision of 23.09.2020 on Zl W256 2226269-1/13E, on the concept of copy, that
"Article 15(1) of the GDPR limits the right of access to personal data within the meaning of Article 4(1) of the GDPR and additional information related thereto as specifically set out in paragraph 2. Since the concept of personal data according to Art 4(1) GDPR must be manifold and not (always) limited to individual data (cf.
Recital 63 with regard to information such as diagnoses,  examination results, findings of the treating physicians and information on treatments and interventions as well as ECJ, 20.12.2017, C434/16 with regard to written answers of an examinee in a professional examination and possible comments of the examiner on these answers), it may therefore  - in accordance with the requirement of transparent information - sometimes be necessary or also appropriate in individual cases that also individual text passages or also documents are made available to the data subject by the controller.
 
 
are to be made available. However, a general right to receive documents in which personal data are processed cannot be derived from Art 15 GDPR.
Art 15(3) GDPR also merely states that the controller must provide a copy of the data that are the subject of the processing.  
This is only a modification of the form of information compared to  Art 12 GDPR and not an independent right to receive a copy, in particular in addition to the right of access under Art 15(1) GDPR. Rather, Art 15(3) GDPR states that the right of access under Art 15(1) GDPR must be provided by the controller in the form of a copy of the data of the data subject, which is why the data subject has a right to receive a copy solely in relation to his or her right of access (see also Paal in Paal-Pauly (ed.), Basic Data Protection Regulation 2 on Art 15,
para 33). "
 The (German) Labour Court in Bonn ruled on 16.07.2020, Zl 3 Ca 2026/19, that
"in the Board's view, the claim for the surrender of a copy of the data merely involves the communication of a list of the data stored. The term copy is to be understood in this respect as a copy of a list of data.
This follows from the interaction of sentence 1 and sentence 2 of Art. 15(3) GDPR and the resulting meaning and purpose of the provision. The provision wants to determine that a "copy" is free of charge and that a fee may be charged for further copies. This becomes clear by looking at the English and  French terms "COPY" and "COPIE" used in the original text of the regulation, which in any case can also be translated as "copy". There are no circumstances apparent from the meaning and purpose of the standard that there should still be an obligation to hand over  documents over and above the information about the stored date, as the plaintiff demands in his application. Thus, should the defendant have stored the statement of a works council member about a hotel booking arranged by the plaintiff, it would be obligated to disclose this stored data to the plaintiff upon a correspondingly specified request for information by the plaintiff. However, the obligation to  provide a copy pursuant to para. 3 of the GDPR does not include the disclosure of the record of this statement.  
 14 —
2.2. in favour of extensive access:
In its judgment of 17.12.2020, 6 Ob 138/20t, the (Austrian) Supreme Court (OGH) had to rule on the question of the free transmission of an entire medical history - going beyond a patient letter - and in doing so pronounced that, according to
"Art 15 (3) GDPR [is] to provide a copy of the personal data which are the subject of the processing. According to Article 4(1) of the GDPR, personal data means any information relating to an identified or identifiable natural person, whereby an identifiable person is one who can be identified directly or indirectly.
As already stated by the lower courts, the legislator of the Regulation explicitly assumes that the data subject's right of access also includes his or her own health-related data, such as data in the patient's files, diagnoses, examination results, findings of the doctors providing follow-up treatment and information on treatments or interventions (GDPR Recital 63).  
If there were data in the medical record that did not relate to the plaintiff, it would have been up to the defendant to bring that forward. However, this would not necessarily result in the dismissal of the action. Rather, in such a case, the data subject would have a claim to the provision of a partial copy containing only the personal data or in which the other data have been made unrecognisable (cf. Bäcker in Kühling/Buchner, DSGVO/BDSG3 Art 15 DSGVO Rz 41).
The copy must be complete (Bäcker in Kühling/Buchner, DSGVO/BDSG3 Art 15 DSGVO Rz 41). Handing over the patient's letter is therefore not sufficient.
Pursuant to Art 15(3) GDPR, the controller shall provide a copy of the personal data undergoing processing; for any further copies requested by the data subject,  the controller may charge a reasonable fee based on the administrative costs.
According to Art 12 (5) of the GDPR, "all notifications and measures pursuant to Articles 15 to 22 and 34 of the GDPR" shall be provided free of charge. It is derived from these provisions that the first copy of the personal data is free of charge for the data subject (Bäcker in Kühling/Buchner, DSGVO/BDSG3 Art 15 DSGVO Rz 45; Dix in Simitis/Hornung/Spiecker, Datenschutzrecht [2019] Art 12 DSGVO Rz30, Art 15 Rz 30;
Ehmann in Ehmann/Selmayr, DS-GV02 [2018]. 	para 28; Paal in Paal/Pauly, DSGVO/BDSG2
 
Art 15 DSGVO Rz 34 f; Franck in Gola, DS-GV0 2 [2018] Art 15 Rz 32; Stollhoffin Auernhammer, DSGVO/BDSG6 [2018] Art 15 Rz 30,- Specht in Sydow, EU-DSGV0 2 Art 15 Rz 20,- Diregger, Handbuch Datenschutzrecht [2018] 733; Souhrada-l< irchmayer, Das Auskunftsrecht nach der Datenschutz-Grundverordnung, Jahrbuch Datenschutzrecht 2017, 75, 80).
As an interim result, it should therefore be noted that Art 15 (3) and Art 12 (5) of the GDPR  basically give rise to the patient's right to be provided with a copy of his medical history, whereby the first copy must be made available free of charge.  
In its decision of 02.03.2020 Zl. W214 2224106-1/13E, the (Austrian) Federal Administrative Court stated in a matter in which a complainant requested information pursuant to Art.  15(3) of the GDPR to list all of her submissions with the date of  receipt and designation of the administrative matter and to provide a free copy that
"It already follows from the wording of Art. 15(3) GDPR that a copy of the data must be sent free of charge to the person requesting the information. Only when the data subject requests more than one
copy, the controller may charge a reasonable fee for these additional copies based on the administrative costs (see also Haidinger in Knyrim, Dati< omm Art 15 DSGVO Rz 36 (as of 1.10.2018, rdb.at)).  
The (German) Administrative Court Schwerin decided on 29.04.2021, Zl. 1 A 1343/19 SN, on the provision of a copy of an expert opinion to the effect  that
 " what is to be understood by "copy" pursuant to Art. 15 (3) GDPR [is] disputed. According to an extensive view, all stored and/or processed personal data must be transmitted in the present raw version (so: Kühling/Buchner/Bäcker, 3rd ed.  
2020, DS-GVO Art. 15 Rn. 39a,- BeckOK DatenschutzR/B.-Wudy, 34th ed. 1 November 2020, DS  GVO Art. 15 Rn. 85; Halder/Johanson, NJOZ 2019, 1457 (1459); VG Gelsenkirchen, judgment of.
 27 April 2020 - 20 K 6392/18, NVwZ-RR 2020, 1070 marginal no. 78, beck-online; AG Bonn, judgment of
30 July 2020 118 C 315/19, BeckRS 2020, 19548 Rn. 15, 16); according to the restrictive opposing view, Art. 15 (3) sentence 1 DS-GVO merely regulates a special form of information and only refers to the information from (1), which, however, does not contain a claim to complete data information, but only to an overview of the data (cf. on the state of the dispute:  BeckOK DatenschutzR/B.-Wudy, 34th ed. 1 November 2020, GDPR Art. 15 marginal no. 85; and Paal/Pauly/Paa1, 3rd ed. 2021, GDPR marginal no. 33 with further references).  
 
The court has already explained above that it assumes that the GDPR is based on an extensive understanding of personal data. The restrictive view that information must only be provided in the form of an overview of the stored information must therefore be rejected. From the court's point of view, it is irrelevant whether Article 15 (3) of the GDPR constitutes an independent right or only an extension of the right to information contained in Article 15 (1) of the GDPR. This is because personal data should be comprehensively protected. This protection can only be consistently realised if information is provided about the data stored in full. Article 15 of the GDPR can only be understood in its entirety in such a way that either the "right of access to this personal data pursuant to Article 15(1)(2) of the GDPR already includes a right of access to all information (wording: "information on this personal data and the following information"), which is extended by paragraph 3 to the effect that the data subject is also entitled to be provided with a copy of the data, or in the right of access to the personal data pursuant to Article 15(1)(3) of the GDPR the right to be provided with a copy of the data.
 copy" pursuant to Article 15 (3) of the GDPR is to be seen as an independent claim to the provision of the complete information. Otherwise, a review of the accuracy of the stored data and the right to rectification under Article 16 GDPR would not be feasible. Without knowledge of the specific data, a check for accuracy is not possible. On the basis of an overview that, for example, name, address and a certain number of photos, etc. are stored, it is not possible to check whether the data have also been recorded correctly in terms of content, for example whether the name has been spelled correctly or whether there is any connection at all with the person concerned in the case of assigned photos. For example, pictures of different property objects may be incorrectly assigned. Even if the greatest possible care is assumed, it cannot be ruled out that a correct allocation will be made in every case when processing large volumes of data. This applies in particular if the information concerned is similar (examples: Photos of identical terraced houses or of identical twins), the data were recorded on a data carrier and a final allocation to a file or a data record is only made afterwards. A review of the correct recording by the data subject is only possible with complete knowledge of the data. The same applies to the right to erasure under Article 17 of the GDPR. Recital 63 of the GDPR also supports this view. It shows that the legislator wants to enable independent and direct access by the data subject to his or her data ("Where possible, the controller should be able to provide remote access to a secure system that would allow the data subject direct access to his or her personal data"). It is not mentioned that the data subject should have access to an overview of his personal data, but 'direct access' to the data.  
3.	Considerations of the Deciding Senate:
3.1.	The question still to be assessed by the Federal Administrative Court in the present appeal proceedings is whether the transmission of the complainant's personal  data in the context of a table and an overview in the credit agency's information letter complied with the legal right under Art. 15 para. 3 GDPR to receive a copy, or whether the complainant has a legal right to receive a copy of his personal data processed by the involved party, not in an isolated form, but in the form of  copies or excerpts of any correspondence and database contents or similar. If the latter is affirmed, his complaint in this regard must be upheld, since such documents have not yet been handed over by the intervening party and the data protection authority denied such a claim in the contested decision.  
3.2.	On the basis of the disputed doctrinal opinions and the likewise inconsistent case law from the exemplary examples, the question arises for the deciding Senate as to what exactly is meant literally by the term "copy" in Article 15 (3) sentence 1 of the GDPR (reference question 1).
Is this also a specification or modification of the general right of access under Article 15(1) of the GDPR and does the provision rather specify how a data subject should obtain information about his or her personal data that are being processed ? Or does the provision in fact standardise a separate,  independent legal right to a photocopy/facsimile/database printout or (electronic) database extract or to a copy of entire documents and records in which personal data of the data subject appear, which goes beyond the right of access under Article 15(1) GDPR? These questions give rise to Question 2.
The more restrictive approach in literature and jurisprudence is oriented towards the purpose of the norm for the
 The right of access is, in simple terms, a preparation for the exercise of other data subject rights and, in this sense, focuses more on information about the personal data processed , including in aggregated form, for example in a list. Extensive access is the first step towards the broad protective purpose pursued by the GDPR as a whole, from which an increased power of control of the data subject may result: according to this, the legal right to receive a copy of the data in the form of a photocopy, a facsimile, a database printout or an (electronic) database extract, or a copy of entire documents and records, would strengthen the verifiability, according to some, make it possible in the first place.
Both approaches also refer to the provision of Art 15(4) GDPR as an interpretative aid, according to which the right to receive a copy pursuant to para. 3 must not affect the rights and freedoms of other persons. It could be deduced from this provision that the personal data to be copied must not be provided alone, but always in the context of their processing, i.e. as part of a whole document (such as an e-mail) or an extract from a database that goes beyond the personal data in scope. However, it could also be inferred that the provision refers solely to those cases in which the personal data to be accessed and copied, which are the subject of the processing, cannot be isolated because they are inextricably linked to protected data of third parties, such as in the case of a film recording which also shows other persons.
In the event of a restrictive interpretation of Art. 15 (3) sentence 1 DSGVO to the effect that with
 In the light of the types of data explicitly mentioned in recital 63 and the transparency requirement of Article 12(1) of the GDPR, the question arises whether, in individual cases and due to the nature of the personal data processed, there may be an obligation on the part of a controller to provide copies of parts of texts or documents (reference question 3).
Finally, the term "information" in Art 15 (3) sentence 3 GDPR is also used for both interpretations - restrictive and extensive - which is why it seems necessary to ask whether this term now refers solely to the "personal data which are the subject of processing" referred to in Art 15 (3) sentence 1 (reference question 4) or goes beyond this and also includes the information pursuant to Art 15 (1) lit a) to h) (reference question 4.a). 3, first sentence, refers to the "personal data which are the subject of the processing" (question 4), or goes beyond this and also includes the information pursuant to Art 15(1)(a) to (h) (question 4.a) or goes even further and means, for example, metadata associated with the data (question 4.b).
The deciding senate does not overlook the fact that the Supreme Court in Austria has already made a statement in its judgment of 17.12.2020, Zl. 6 Ob 138/20t, that a right of the patient to be provided with a copy of the medical history results in principle from Art. 15(3), Art. 12(5) of the GDPR. Recital 63 explicitly mentions data from patient records. The statement of the Supreme Court can be seen "only" in relation to medical records, as a particularly essential and sensitive form of personal data, or also as a statement of a  general right to receive copies of processed personal data.
(3) So far as can be ascertained, there is no evidence of any infringement of the rights of the defence in respect of the questions referred for a preliminary ruling in the operative part of this judgment.
GDPR, there is no case law of the Court of Justice of the European Union. Since the
Since, for the reasons stated above, the correct application of Union law, that is to say of the first sentence of Article 15(3) of the GDPR, does not appear to the Federal Administrative Court to be so obvious that there is no room for reasonable doubt (see ECJ, Judgment of 6 October 1982, Case 282/81 [1982] ECR 3415), the questions referred for a preliminary ruling set out in the operative part are referred to the Court under Article 267 TFEU.
Reference for a preliminary ruling
VII. Information to the parties:
1.	Pursuant to § 17 VwGVG in conjunction with § 38a AVG, if the Administrative Court has referred a question to the Court of Justice of the European Union for a preliminary ruling, it may, until receipt of the preliminary ruling, only take such actions or make such decisions and orders which cannot be influenced by the preliminary ruling or which do not conclusively settle the question and do not permit a stay. A formal stay of proceedings by an independently contestable act is not provided for. The legal effects of § 38a AVG take effect ex lege at the time the application is filed and last until the preliminary ruling is received (cf. Hengstschläger/Leeb, AVG § 38a,  RZ 12 [as of 1.4.2021, rdb.a]).
2.	An appeal against the order for reference to the Court of Justice of the
In view of the fundamental competence of the Court of Justice of the European Union under Union law to decide on the eligibility for referral, this must be denied (cf. VwGH, 22.02.2001, Zl. 2001/04/0034 mwN, VwGH,
28.10.2008, zi 2008/05/0129).
FEDERAL ADMINISTRATIVE COURT
Judicial Division W211, at 09.08.2021
Mag. a Barbara SIMMA LL.M.
6	Signatory	Mag. , Lt.. M. Barbara Simma
	Date/Time UTC	2021-08-09T13: 35: 	00
	Test information	Information on the verification of electronic signatures can be found at: https : / sxgnaturpruefung . gv . at
Note	This t'ocument, which is provided with a qualified electronic signature, shall, in accordance with Article 25(2) of the Regulation
(EU) No 910/2014 of 23 July 2014 ('eroAS-V0'þ shall have the same legal effect as a document signed by hand .
(JUDGE.)
 

BVwG
Federal Administrative Court	Signatory	Federal Administrative Court
	Date/Time	 
	Exhibitor certificate	CN=a-sign-corporate-light-02,OU=a-sign-corporate-light-02,O=A-Trust Ges. f Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
	Serial No.	1054911121
Note	This document has been officially signed.
 
Test information	Information on the verification of the electronic seal or electronic signature can be found at: https://www.signatur.rtr.at/de/vd/Pruefung.html.
Information on how to check the printout can be found at: https://www.bvwg.gv.at/service/amtssignatur