BVwG - W211 2222613-2/12E
From GDPRhub
| BVwG - W211 2222613-2/12E (request for preliminary ruling under Article 267 TFEU) | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 15(3) GDPR Article 267 TFEU |
| Decided: | 09.08.2021 |
| Published: | |
| Parties: | 1. unknown (complainant before the Austrian Data Protection Autority) 2. CRIF GmbH (Austrian credit reference agency, respondent before the Austrian Data Protection Autority) 3. Datenschutzbehörde - DSB (Austrian Data Protection Authority) |
| National Case Number/Name: | W211 2222613-2/12E (request for preliminary ruling under Article 267 TFEU) |
| European Case Law Identifier: | |
| Appeal from: | DSB (Austria) DSB-D124.059/0005-DSB/2019 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | n/a |
The Austrian Federal Administrative Court requested the CJEU's preliminary ruling on the interpretation of Article 15(3) GDPR. In particular, it asked for clarification on the meaning and extent of "a copy of the personal data undergoing processing" and "information".
English Summary
Facts
A data subject (the complainant) sent an access request to an Austrian credit reference agency (the respondent), requesting (i.a.) a copy of their personal data undergoing processing pursuant to Article 15(3) in a commonly used electronic format.
The respondent only provided a table that contained the personal data (name, date of birth, address data business functions of the data subject) in an aggregated form but refused to provide an actual copy of the data undergoing processing, such as database print-outs or email correspondence regarding the complainant. The respondent argued that Article 15(3) GDPR does not entitle a data subject to receive a copy of the data in the sense of a facsimile of the data. Furthermore, the disclosure of a copy would also violate the respondent's business secrets, since a copy of data from a relational database (such as the respondent's identity and creditworthiness database) would inevitably also reproduce the logical-mathematical links of the individual data records.
The complainant argued that Article 15(3) GDPR entitles them to a copy of the data in the very form that these data are undergoing processing. A controller has no right to limit the right of access to a modified aggregation of the relevant data.
The Austrian Data Protection authority (Datenschutzbehörde - DSB) followed the respondents argument and rejected the complainant's claim. It deemed the data and information provided by the respondent to be sufficient.
The complainant consequently filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG).
Holding
The BVwG stayed the procedure and requested the CJEU's preliminary ruling under Article 267 TFEU on the following questions:
1. Is the term "copy" in Article 15(3) GDPR to be interpreted as meaning a photocopy or facsimile or an electronic copy of (electronic) data, or does the term also cover a "transcript", un "double" ("duplicata") or a "transcript", as understood in German, French and English dictionaries?
2. Must the first sentence of Article 15(3) of the GDPR, according to which "the controller shall provide a copy of the personal data undergoing processing", be interpreted as implying a general legal right of a data subject to obtain a copy of - also - all documents relating to him or her or the provision of a copy of an extract from the database where the personal data are processed in such a database, or does this mean that the data subject has a legal right - only - to a faithful reproduction of the personal data to be provided with information pursuant to Article 15(1) of the GDPR?
3. In the event that the answer to question 2 is that the data subject only has a legal right to a faithful reproduction of the personal data to be provided pursuant to Article 15(1) GDPR: must Article 15(3) first sentence of the GDPR be interpreted as meaning that, due to the nature of the data processed (e.g. with regard to the diagnoses or examination results referred to in recital 63 or documents in connection with an examination within the meaning of the judgment of the CJEU of 20.12.2017, C-434/16) and the transparency requirement in Article 12(1) GDPR it may nevertheless be necessary in individual cases to also make text passages or entire documents available to the data subject?
4. Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as meaning only the "personal data undergoing processing" referred to in the first sentence of Article 15(3) GDPR?
a. If the answer to question 4 is in the negative: Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as including, in addition, the information referred to in Article 15(1)(a) to (h) of the GDPR?
b. If question 4.a. is also answered in the negative: Is the concept of "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the request is made electronically, "unless otherwise requested by the data subject", to be interpreted as referring to the "personal data undergoing processing", the information referred to in Article 15(1)(a) to (h) GDPR and information going beyond these information, such as for example associated metadata?
Comment
1) The procedure before the DSB and the BVwG also concerned other GDPR violations by the respondent. Regarding these issues, the BVwG issued a separate decision (see here).
2) The CJEU has already assigned a case number: C-487/21 (see here and here).
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Court
Federal Administrative Court
Decision date
09.08.2021
Business number
W211 2222613-2
Saying
W211 2222613-2/12E
DECISION
The Federal Administrative Court decides by Judge Mag.a Barbara SIMMA LL.M. as chairperson and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as associate judge on the complaint of XXXX against the decision of the data protection authority of XXXX 2019, XXXX , regarding the provision of a copy of the processed personal data in the context of a request for information pursuant to Art. 15 para. 3 of the GDPR in closed session:
The following questions are referred to the Court of Justice of the European Union for a preliminary ruling pursuant to Article 267 TFEU:
1. Is the term 'copy' in Article 15(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, OJ 2016 L 119/1, p. 1; hereinafter 'GDPR') to be interpreted as meaning a photocopy or facsimile or electronic copy of an (electronic) date or does it fall within the scope of the GDPR? 1; hereinafter 'the GDPR') to be interpreted as meaning a photocopy or facsimile or an electronic copy of an (electronic) datum, or does the term also include a 'transcript', un 'double' ('duplicata') or a 'transcript', following the understanding of the terms in German, French and English dictionaries?
2. Is Article 15(3), first sentence, of the GDPR, according to which "the controller shall provide a copy of the personal data undergoing processing", to be interpreted to the effect that it contains a general legal right of a data subject to receive a copy - also - of entire documents in which personal data of the data subject are processed, or to receive a copy of a database extract when the personal data are processed in such a document? to receive a copy of an extract from a database where the personal data are processed in such a database, or does this mean that the data subject has a legal right - only - to a faithful reproduction of the personal data to be provided pursuant to Article 15(1) of the GDPR?
3. In the event that the answer to question 2 is that the data subject only has a legal right to a faithful reproduction of the personal data to be provided pursuant to Article 15(1) of the GDPR, Article 15(3) sentence 1 of the GDPR must be interpreted as meaning that, due to the nature of the data processed (e.g. with regard to diagnoses, examination results or findings), it is not possible to provide the data subject with the original data. 3, first sentence, be interpreted as meaning that, due to the nature of the data processed (for example, in relation to the diagnoses, examination results, findings or also documents in connection with an examination within the meaning of the judgment of the Court of Justice of the European Union of 20 December 2017, C-434/16, ECLI:EU:C:2017:994) and the transparency requirement in Article 12(1) of the GDPR, it may nevertheless be necessary in individual cases to make text passages or entire documents available to the data subject?
4. Is the term 'information' which, under the third sentence of Article 15(3) of the GDPR, must be provided to the data subject 'in a commonly used electronic format' where the data subject makes the request electronically 'unless he indicates otherwise' to be interpreted as meaning only the 'personal data undergoing processing' referred to in the first sentence of Article 15(3)?
a. If question 4. is answered in the negative: Is the term 'information', which under the third sentence of Article 15(3) of the GDPR must be provided to the data subject 'in a commonly used electronic format' if the data subject submits the request electronically, 'unless the data subject indicates otherwise', to be interpreted as also referring to the information pursuant to Article 15(1)(a) to (h) of the GDPR?
b. If question 4.a. is also answered in the negative: Is the term 'information', which under the third sentence of Article 15(3) of the GDPR must be provided to the data subject 'in a commonly used electronic format' if the data subject makes the request electronically 'unless he or she indicates otherwise', to be interpreted as meaning, for example, associated metadata in addition to the 'personal data which are the subject of the processing' and the information referred to in Article 15(1)(a) - (h) of the GDPR?
Text
Justification:
I. Facts:
By letter of XXXX 2018, the complainant asked a credit reference agency for (among other things) information on personal data pursuant to Article 15 of the GDPR and further, to the extent relevant here, for a copy of the data processed about him in a standard technical format.
The credit agency partly provided the requested information in an aggregated form, reproducing the data stored on the complainant's person on the one hand in a table broken down by name, date of birth, street, postcode and town, and on the other hand in an overview concerning business functions and powers of representation. Additional documents such as e-mails or database printouts were not submitted.
II. submissions of the parties:
The complainant argues that a "copy of the data" means, for example, e-mails and database extracts, including any free text fields, which contain personal data. The right to a copy of the data exists independently of the right to information on the content of the data processed, whereby a processing of the copy of the data is not permissible, except in the cases of Article 15(4). With regard to the earlier case law of the then Data Protection Commission, which had refused to hand over a copy of the data, it had to be said that the legal situation had changed with the GDPR. In Austria, the Supreme Court (hereinafter "OGH") had already stated in its decision of 17 December 2020 on the new legal situation under the GDPR that, for example, the production of copies of medical records was a case of application of Article 15(3) of the GDPR (see OGH, 17 December 2020, Zl. 6 Ob 138/20t). In a decision of 24 May 2019, the Federal Administrative Court also stated that duplicates of bank statements would fall under the right to copies under Article 15(3) of the GDPR (Zl W258 2205602-1).
The respondent - now the party involved in the proceedings before the Federal Administrative Court - argues that a surrender of the copy of the data must be denied in principle and that in the present case, no added value for the complainant could be discerned. All information and data would result from the request for information and the information, and no further data would be stored. The disclosure of a copy would also violate the respondent's business secrets, since a copy of data from the relational database would inevitably also reproduce the logical-mathematical links of the individual data records.
The data protection authority argues that neither the legislator nor the recitals nor the literature assume that the complainant would be entitled to a copy in the form of a facsimile. Rather, it assumes that, in principle, the right to information on one's own data under data protection law is an accompanying procedural right to check whether data are processed in accordance with the law. In this sense, the European Court of Justice had already stated that the right of access served to prepare the correction, deletion or blocking of data (see Rijkebeer, ECLI:EU:C:2009:293 and Y.S. and others, C-141/12 and C-372/12, ECLI:EU:C:2014:2081). Accordingly, the complainant's interest, irrespective of what could be asserted in the right to information, was thus normatively limited. It was also apparent from this that a facsimile was not the subject of the right of access. With reference to recital 63 of the GDPR and the judgment of the European Court of Justice of 14 July 2014, [YS and others], C-141/12 and C-372/12, ECLI:EU:C:2014:2081, the data protection authority had already stated that no claim to the disclosure of a copy of documents containing personal data of an information seeker could be derived from Art 15(3) GDPR. Article 15(3) of the GDPR only provides for the right to receive a "copy of the personal data which are the subject of the processing". On the basis of these considerations, the surrender of copies of documents in the form of entire facsimiles could not be requested on the basis of Article 15(3) of the GDPR, as this could not be inferred from the wording of the provision. The Directive 2011/24/EU also speaks against such a surrender of entire documents: its Article 2 lit c refers to Directive 95/46/EC (now the GDPR) and leaves it unaffected. Art 4(1)(f) and Art 5(d) of Directive 2011/24/EU explicitly provide for a right to receive a copy of "the patient's file" - i.e. a right to receive entire copies of documents. If, in the light of this provision, Article 15(3) of the GDPR were to be interpreted as having a content aimed at the disclosure of entire documents, the provisions of other legal acts, such as Directive 2011/24/EU, would be rendered meaningless. Therefore, the legal opinion of the Supreme Court in its judgement in no. 6 Ob 138/20t was also not to be followed, because it had completely disregarded the aforementioned directive in its decision.
III. previous procedure:
Following a request for information and an initial partial provision of information by the credit reference agency, the complainant lodged a complaint with the data protection authority on XXXX .2019 on the grounds of inadequate response to the request for information, alleging, inter alia, that he had not been provided with a copy of the data.
After a written procedure, the data protection authority issued a decision on XXXX 2019 rejecting - among others - the complaint for breach of the right of access.
The complainant filed an appeal against the decision with the Federal Administrative Court.
The Federal Administrative Court shall decide on the appeal against the decision of the data protection authority of XXXX 2019:
In its partial decision of XXXX 2021, the Federal Administrative Court ruled on the objections regarding the provision of information on the origin of the data, the storage period and the processing purposes, as well as regarding the alleged violation of information obligations pursuant to Article 14 of the GDPR, regarding the alleged violation of the right to confidentiality pursuant to Section 1 of the GDPR, as well as the alleged violation of the data minimisation obligation pursuant to Article 5 of the GDPR and the data protection obligations pursuant to Article 25 of the GDPR.
The Federal Administrative Court decides to refer the appeal to the Court of Justice of the European Union for a ruling on essential questions of Union law with regard to the objection to Art 15(3) of the GDPR.
IV. Applicable Union law:
GDPR:
Article 4
Definitions
For the purposes of this Regulation, the term:
1. "personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; [...].
Article 12
Transparent information, communication and modalities for the exercise of the data subject's rights
(The controller shall take appropriate measures to provide the data subject with all the information referred to in Articles 13 and 14 and all the notifications referred to in Articles 15 to 22 and Article 34 relating to the processing in a precise, transparent, intelligible and easily accessible form in plain and simple language, in particular information specifically addressed to children. The information shall be provided in writing or in another form, including, where appropriate, by electronic means. If requested by the data subject, the information may be provided orally, provided that the identity of the data subject has been established in another form.
The controller shall facilitate the exercise by the data subject of his or her rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller may refuse to act on the data subject's request to exercise his or her rights under Articles 15 to 22 only if he or she credibly demonstrates that he or she is unable to identify the data subject.
(3. The controller shall provide the data subject with information on the measures taken upon request in accordance with Articles 15 to 22 without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months if necessary taking into account the complexity and the number of requests. The controller shall inform the data subject of any extension of the time limit, together with the reasons for the delay, within one month of receipt of the request. If the data subject makes the request electronically, he or she shall be informed by electronic means where possible, unless he or she indicates otherwise.
(4. If the controller fails to act on the request of the data subject, he shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons therefor and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.
(5. Information pursuant to Articles 13 and 14 and any notices and measures pursuant to Articles 15 to 22 and Article 34 shall be provided free of charge. In the case of manifestly unfounded or, in particular in the case of frequent repetition, excessive requests by a data subject, the controller may either
(a) charge a reasonable fee which takes into account the administrative costs of informing or notifying or implementing the requested measure; or
(b) refuse to act on the application.
The responsible person shall provide evidence of the manifestly unfounded or excessive nature of the request.
(6. Without prejudice to Article 11, where the controller has reasonable doubts as to the identity of the natural person making the request under Articles 15 to 21, the controller may request additional information necessary to confirm the identity of the data subject.
(7. The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give a meaningful overview of the intended processing in an easily perceivable, intelligible and clearly comprehensible form. If the pictorial symbols are presented in electronic form, they shall be machine-readable.
(8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 concerning the definition of the information to be represented by graphic symbols and the procedures for the provision of standardised graphic symbols.
Article 15
Right of information of the data subject
(1. The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed and, if so, the right to obtain access to those personal data and the following information:
(a) the purposes of the processing;
(b) the categories of personal data processed;
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations;
(d) if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining that duration;
(e) the existence of a right to obtain the rectification or erasure of personal data concerning him or her, or the restriction of processing by the controller, or a right to object to such processing;
f) the existence of a right of appeal to a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information on the origin of the data;
(h) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.
(2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards referred to in Article 46 in relation to the transfer.
(3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless the data subject indicates otherwise.
(4) The right to receive a copy under paragraph (3) shall not prejudice the rights and freedoms of other persons.
V. On the right of presentation:
The Federal Administrative Court is a court within the meaning of Art 267 TFEU.
VI. the grounds for the questions referred:
(1) On the question of what exactly is meant by a "copy of the personal data which are the subject of the processing" in Art 15(3) GDPR, there are different doctrinal opinions in Austria and Germany:
1.1 For a restrictive view: right to copy as a more detailed specification of the right of access; no right to documents or similar:
According to Paal in Paal/Pauly [eds.], Datenschutz-Grundverordnung, Bundesdatenschutzgesetz (DS-GVO/BDSG3), C.H. Beck, 2021, Art 15 RZ 33f, the term copy in para. 3 refers to the information to be provided pursuant to para. 1 with regard to the personal data, so that the substantive scope of the right to copy can in no way go beyond the right to information regulated in para. 1. The purpose of Article 15 is to enable data subjects to check the lawfulness of data processing, and this interpretation is underlined by the first sentence of recital 63. For this purpose, it was sufficient for the data subject to receive a copy of the information mentioned in paragraph 1 lit. a to h. The data subject was not required to provide further information. Further information was not necessary. For the companies concerned, a view that went beyond this would mean increased financial, practical and legal expense. In the case of an extensive interpretation, a balancing with the rights and freedoms of third parties (paragraph 4) would not be possible. However, the need for such a balancing is (indirectly) clarified by recital 63.
Jahnel states in the Commentary on the GDPR, Jan Sramek Verlag, 2021, Art 15, RZ 37f, 42f, that the systematics of Art 15(3) raises, among others, the question whether the scope of the right under Art 15(3) goes so far as to grant the data subject a right to a copy of all documents stored with the controller? According to the dictionary, a copy means a "transcript, copy or other reproduction true to the original". According to Article 15(3), a copy of the data being processed must be made available, and not a copy of the documents in which the data are used. Therefore, this term was to be understood as the right to a faithful representation of the data that were the subject of the processing. In order to meet the requirements of "faithful representation", the data actually processed would have to be reproduced from the actual data processing and thus copied and recorded. The purpose of this arrangement could then be seen in ensuring data identity when providing information, and thus in the correctness of the data information with regard to the concretely processed data. This is fulfilled if the controller exports the processed data categories together with their concrete content concerning the information seeker directly from the data processing, i.e. "copies" them in this sense. Interpreted in this way, Article 15(3), first sentence, is to be understood as a more detailed specification of the general right to information on personal data in Article 15(1), which only stipulates the basic right to information, but does not contain any information on the form and content of the provision of information.
Article 15(4) states that the right to receive a copy "in accordance with paragraph 3" must not affect the rights and freedoms of other persons. At first glance, this explicit reference to the right to a copy in para. 3 seems to contradict the system developed so far, because according to the wording, it only refers to the right to a copy and not to the right to information on the content according to Art 15 para. 1. However, this contradiction would be resolved if the right to copy were to be regarded as a more detailed provision regarding the manner in which information on personal data of the data subject was to be provided under Article 15(1). In that case, the obligation to weigh up the interests would relate to the entire provision of information. This view was also underlined by recital 63. Although this recital does not contain any clues as to the interpretation of the right to copy under Article 15(3), it clearly expresses two things: firstly, a statement about the purpose of the right of access, namely "to be aware of the processing and to be able to check its lawfulness". Thus, Article 15 is about the data subject receiving sufficient information about the specific processing in order to be able to assert his or her rights, and not about receiving duplicates of all documents of the controller(s) containing his or her data. Furthermore, the right of access should not "affect the rights and freedoms of other persons [...]". It could be concluded from this that the European legislator wanted the balancing of interests according to Article 15(4) to be applied to the entire right of access, i.e. both to the right of access according to Article 15(1) and to its further specification in the form of the right to a copy according to Article 15(3).
1.2 For an extensive view:
Dix in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht, DSGVO mit BDSG, Nomos Verlagsgesellschaft, 2019, Art 15, RZ 28, 33, argues that the GDPR for the first time grants the data subject a right to a copy of the data concerning him or her that are the subject of the processing. This right to a copy of data significantly strengthens the position of the data subject. The right to a copy of data was a special form of access and not a separate obligation to surrender. It referred to the information to be provided under paragraph 1 about the data processed about the data subject. However, the right to copy data was not identical to the right to information; the copy could not replace the information because the copied data set often had to be supplemented by explanatory information in order to be comprehensible to the data subject. According to Article 12(1), the data controller is obliged to ensure comprehensibility - if necessary - by answering queries. The right to copy data according to para. 3 sentence 1 refers to the data in the form in which it is available to the person responsible (for example, in principle also genetic raw data of patients or test persons). The data controller is not obliged to prepare the data in a specific form so that the data subject can process it further. The only exception is when a copy of the data is requested electronically.
If the controller provided the data subject with a copy of his/her data, this should not affect the rights and freedoms of other persons. The rights and freedoms of third parties could be affected by processing the data subject's data together with the data of third parties (for example, in the form of paper lists). As a rule, however, this does not justify a complete refusal to provide the data subject with a copy. Rather, in the case of conventional (analogue) data processing, the controller must blacken the data sheets for the provision of the copy. In the case of automated data processing, the production of a partial electronic copy is unproblematic in any case if the data does not have a double or multiple personal reference.
Haidinger, in Knyrim [ed.], Der DatKomm, Praxiskommentar zum Datenschutzrecht, DSGVO und DSG, Manz Verlag, 2021, Art 15 DSGVO, para. 35, takes the view that the data subject has a right to a copy of the data that is the subject of the processing, over and above the information as to which data about him or her is actually processed. The (former Austrian) Data Protection Commission has so far expressly denied the right to receive a copy of the data. Copies of data meant e-mails, database extracts, etc., which could be quite risky for the controller with regard to free text fields in databases. The right to a copy of the data is independent of the right to information on the content of the data processed. The transmission of the data copy would cover both claims if the data were accessible to the data subject from the copy in accordance with the transparency requirement, i.e. in particular if explanations were attached. Subject to Article 15(4), the data copy itself may not be processed because otherwise the content would be changed.
Ehmann in Ehmann/Selmayr [eds.], Datenschutz-Grundverordnung (DS-GVO2), C.H. Beck, 2018, Art 15, does not address the scope or nature of the copy, but says with regard to para. 3 sentence 3 of Art 15 of the GDPR that this refers to the fact that "information" must be made available and not only the personal data, which does not constitute an inaccuracy in the wording. Paragraph 3, sentences 1 and 2 correctly refer to a "copy of the personal data", as only this could be the subject of a copy by the controller. Paragraph 3, sentence 3, on the other hand, uses the term "information" to also specify the form in which the associated metadata must be made available in addition to the "actual" personal data.
2 Similarly, Austrian and German courts come to different interpretations on this question:
2.1 For restrictive access:
The (Austrian) Federal Administrative Court ruled in its decision of 23.09.2020 on Zl W256 2226269-1/13E, on the concept of a copy, that
"Article 15(1) of the GDPR restricts the right of access to personal data within the meaning of Article 4(1) of the GDPR and additional information specifically defined in paragraph 2. Since the concept of personal data under Art 4(1) DPA is multifaceted and not (always) limited to individual data (see recital 63 in relation to information such as diagnoses, examination results, findings of the treating physicians and information on treatments and interventions, as well as ECJ, 20.12. 2017, C434/16 in relation to the right of access to personal data under Art 4(1) DPA).2017, C434/16 in relation to written answers of an examinee in a professional examination and possible comments of the examiner on these answers), it may therefore be necessary or appropriate in individual cases - in line with the requirement of transparent information - that individual text passages or also documents are to be made available to the data subject by the controller. However, a general right to receive documents in which personal data are processed cannot be derived from Article 15 GDPR.
Article 15(3) of the GDPR also merely states that the controller must provide a copy of the data that is the subject of the processing.
This is only a modification of the form of information in comparison to Art 12 GDPR and not an independent right to receive a copy, in particular in addition to the right of access under Art 15(1) GDPR. Rather, Art 15(3) GDPR states that the right of access under Art 15(1) GDPR must be provided by the controller in the form of a copy of the data of the data subject, which is why the data subject has a right to receive a copy solely in relation to his or her right of access (see also Paal in Paal-Pauly (ed.), Basic Data Protection Regulation² on Art 15, para 33)."
The (German) Labour Court in Bonn ruled on 16.07.2020, Zl 3 Ca 2026/19, that
"in the Board's view, the claim to the surrender of a copy of the data merely involves the transmission of a list of the data stored. The term copy is to be understood in this respect as a copy of a list of data.
This follows from the interaction of sentence 1 and sentence 2 of Art. 15 (3) GDPR and the resulting meaning and purpose of the provision. The provision wants to determine that a "copy" is free of charge and that a fee can be charged for further copies. This becomes clear by looking at the English and French terms "COPY" and "COPIE" used in the original text of the regulation, which can in any case also be translated as "copy". There are no circumstances apparent from the meaning and purpose of the standard that there should be an obligation to surrender documents beyond the information about the stored date, as the plaintiff demands with his application. Thus, should the defendant have stored the statement of a works council member about a hotel booking arranged by the plaintiff, it would be obliged to disclose this stored data to the plaintiff upon a correspondingly specified request for information by the plaintiff. However, the obligation to provide a copy pursuant to Article 15(3) of the GDPR does not include the disclosure of the record of this statement".
2.2 For extensive access:
In its judgment of 17 December 2020, 6 Ob 138/20t, the (Austrian) Supreme Court (OGH) had to rule on the question of the free transmission of an entire medical history - going beyond a patient letter - and thereby pronounced that, according to
"Article 15(3) of the GDPR provides for the provision of a copy of the personal data which are the subject of the processing. According to Article 4(1) of the GDPR, personal data means any information relating to an identified or identifiable natural person, whereby an identifiable person is one who can be identified directly or indirectly.
As the lower courts have already pointed out, the legislator of the Regulation expressly assumes that the data subject's right of access also includes his or her own health-related data, such as data in the patient's files, diagnoses, results of examinations, findings of the doctors providing follow-up treatment and information on treatments or interventions (GDPR Recital 63). […]
If the medical records contained data that did not relate to the plaintiff, it would have been up to the defendant to bring this forward. However, this would not necessarily result in the dismissal of the case. Rather, in such a case, the data subject would have a claim to the provision of a partial copy containing only the personal data or in which the other data have been made unrecognisable (cf. Bäcker in Kühling/Buchner, DSGVO/BDSG³ Art 15 DSGVO Rz 41).
The copy must be complete (Bäcker in Kühling/Buchner, DSGVO/BDSG³ Art 15 DSGVO Rz 41). Handing over the patient's letter is therefore not sufficient.
Pursuant to Art 15(3) GDPR, the controller shall provide a copy of the personal data subject to processing; for any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs.
According to Art 12 (5) GDPR, "all notifications and measures pursuant to Articles 15 to 22 and 34 GDPR" shall be made available free of charge. […It is derived from these provisions that the first copy of the personal data is free of charge for the data subject (Bäcker in Kühling/Buchner, DSGVO/BDSG³ Art 15 DSGVO Rz 45; Dix in Simitis/Hornung/Spiecker, Datenschutzrecht [2019] Art 12 DSGVO Rz 30, Art 15 Rz 30; Ehmann in Ehmann/Selmayr, DS-GVO² [2018] Art 15 Rz 28; Paal in Paal/Pauly, DSGVO/BDSG² Art 15 DSGVO Rz 34 f; Franck in Gola, DS-GVO² [2018] Art 15 Rz 32; Stollhoff in Auernhammer, DSGVO/BDSG6 [2018] Art 15 Rz 30; Specht in Sydow, EU-DSGVO² Art 15 Rz 20; Diregger, Handbuch Datenschutzrecht [2018] 733; Souhrada-Kirchmayer, Das Auskunftsrecht nach der Datenschutz-Grundverordnung, Jahrbuch Datenschutzrecht 2017, 75, 80).
As an interim result, it can therefore be stated that the patient's right to be provided with a copy of his or her medical history arises in principle from Art 15(3), Art 12(5) of the GDPR, whereby the first copy must be provided free of charge."
In its decision of 02.03.2020 on Zl. W214 2224106-1/13E, the (Austrian) Federal Administrative Court stated in a matter in which a complainant requested information pursuant to Art 15(3) of the GDPR to list all of her submissions with the date of receipt and designation of the administrative matter and to provide a free copy that
"It already follows from the wording of Art. 15(3) GDPR that one copy of the data must be sent to the person requesting information free of charge. Only if the data subject requests more than one copy may the controller charge an appropriate fee for these additional copies based on the administrative costs (see also Haidinger in Knyrim, DatKomm Art 15 DSGVO Rz 36 (as of 1.10.2018, rdb.at))."
The (German) Administrative Court of Schwerin ruled on 29.04.2021, Zl. 1 A 1343/19 SN, on the provision of a copy of an expert opinion to the effect that
"what is to be understood by 'copy' according to Art. 15 (3) GDPR [is] disputed. According to an extensive view, all stored and/or processed personal data must be transmitted in the present raw version (thus: Kühling/Buchner/Bäcker, 3rd ed. 2020, DS-GVO Art. 15 Rn. 39a; BeckOK DatenschutzR/B.-Wudy, 34th ed. 1 November 2020, DS-GVO Art. 15 Rn. 85; Halder/Johanson, NJOZ 2019, 1457 (1459); VG Gelsenkirchen, judgment of 27 April 2020 - 20 K 6392/18, NVwZ-RR 2020, 1070 Rn. 78, beck-online; AG Bonn, judgment of 30 July 2020 - 118 C 315/19, BeckRS 2020, 19548 Rn. 15, 16); according to the restrictive opposite view, Art. 15 (3) sentence 1 DS-GVO only regulates a special form of information and only refers to the information from para. 1, which, however, does not contain a claim to complete data information, but only to an overview of the data (cf. on the state of the dispute: BeckOK DatenschutzR/B.-Wudy, 34th ed. 1 November 2020, GDPR Art. 15 marginal no. 85; and Paal/Pauly/Paal, 3rd ed. 2021, GDPR Art. 15 marginal no. 33 with further references).
The court has already explained above that it assumes that the GDPR is based on an extensive understanding of personal data. The restrictive view that information must only be provided in the form of an overview of the stored information must therefore be rejected. From the court's point of view, it is irrelevant whether Article 15(3) of the GDPR constitutes an independent right or only an extension of the right to information contained in Article 15(1) of the GDPR. After all, personal data should be comprehensively protected. This protection can only be consistently realised if information is provided on the data stored in its entirety. Art. 15 GDPR can only be understood in its entirety in such a way that either the "right of access to this personal data" according to Art. 15(1)(2) GDPR already includes a right of access to all information (wording: "information on this personal data and the following information"), which is extended by para. 3 to the effect that the data subject is also entitled to a copy of the data, or the right to a "copy" under Article 15(3) of the GDPR is to be seen as an independent right to be provided with the complete information. Otherwise, it would not be possible to check the accuracy of the stored data and the right to rectification under Article 16 of the GDPR. Without knowledge of the specific data, a check for accuracy is not possible. On the basis of an overview that, for example, name, address and a certain number of photos, etc. are stored, it is not possible to check whether the content of the data was also recorded correctly, for example whether the name was spelled correctly or whether there is any connection at all with the person concerned in the case of assigned photos. For example, pictures of different property objects may be incorrectly assigned. Even if the greatest possible care is assumed, it cannot be ruled out that a correct allocation will be made in every case when processing large amounts of data. This is especially true if the information in question is similar (examples: Photos of identical terraced houses or identical twins), the data was recorded on a data carrier and a final assignment to a file or a data record is only made afterwards. A review of the correct recording by the person concerned is only possible with complete knowledge of the data. The same applies to the right to erasure under Article 17 of the GDPR. Recital 63 of the GDPR also supports this view. It shows that the legislator wants to enable independent and direct access by the data subject to his or her data ("Where possible, the controller should be able to provide remote access to a secure system that would allow the data subject direct access to his or her personal data"). There is no mention of the data subject having access to an overview of their personal data, but "direct access" to the data."
3. considerations of the deciding senate:
3.1 The question still to be decided by the Federal Administrative Court in the present appeal proceedings is whether the transmission of the complainant's personal data in the form of a table and an overview in the credit reference agency's information letter complied with the legal right under Art. 15 para. 3 GDPR to receive a copy, or whether the complainant has a legal right to receive a copy of his personal data processed by the involved party, not in isolated form, but in the form of copies or excerpts of any correspondence and database contents or similar. If the latter is affirmed, his complaint in this regard must be upheld, as such documents have not yet been handed over by the other party and the data protection authority denied such a claim in the contested decision.
3.2 On the basis of the disputed doctrinal opinions and the likewise inconsistent case law from the exemplary examples, the question arises for the deciding Senate as to what exactly is meant by the term "copy" in the literal sense in Article 15 (3) sentence 1 of the GDPR (question 1).
Is this also a specification or modification of the general right of access under Article 15(1) of the GDPR and does the provision rather specify how a data subject is to receive information about his or her personal data that are being processed? Or does the provision actually standardise a separate, independent legal right to a photocopy/facsimile/database printout or (electronic) database extract or to a copy of entire documents and records in which the data subject's personal data appear, which goes beyond the right of access under Article 15(1) GDPR? These questions give rise to Question 2.
The more restrictive access in literature and case law is oriented towards the normative purpose of the right of access as - to put it simply - preparation for the exercise of further data subject rights and in this sense focuses more on information about the personal data processed, also in aggregated form, for example in a list. Extensive access is the first step towards the far-reaching protective purpose pursued by the GDPR as a whole, from which an increased power of control of the data subject can result: according to this, the legal right to receive a copy of the data in the form of a photocopy, a facsimile, a database printout or an (electronic) database excerpt or a copy of entire documents and records would strengthen the verifiability, according to some, make it possible in the first place.
Both approaches also refer to the provision of Art 15(4) GDPR as an interpretative aid, according to which the right to receive a copy pursuant to para. 3 must not affect the rights and freedoms of other persons. It could be derived from this provision that the personal data to be copied are not to be submitted alone, but always in the context of their processing, i.e. as part of a whole document (such as an e-mail) or an extract from a database that goes beyond the personal data in scope. However, it could also be inferred that the provision refers solely to those cases in which the personal data to be provided and copied, which are the subject of the processing, cannot be isolated because they are inextricably linked to protected data of third parties, such as in the case of a film recording that also shows other persons.
In the event of a restrictive interpretation of Article 15(3), first sentence, of the GDPR to the effect that "copy" does not mean a legal claim to the transmission of photocopies, entire documents or database extracts, the question arises in the light of the types of data explicitly mentioned in recital 63 and the transparency requirement of Article 12(1) of the GDPR as to whether, in individual cases and due to the nature of the personal data processed, there may be an obligation on the part of a data controller to provide copies of parts of texts or documents (question 3).
Finally, the term "information" in Art 15 (3) sentence 3 GDPR is used for both interpretations - restrictive and extensive - which is why it seems necessary to ask whether this term refers solely to the "personal data which are the subject of processing" referred to in Art 15 (3) sentence 1 (reference question 4) or whether it goes beyond this and also includes the information pursuant to Art 15 (1) lit a) to h) (reference question 4.a). 3, first sentence, refers only to the "personal data which are the subject of the processing" (question 4), or goes beyond this and also includes the information pursuant to Art 15(1)(a) to (h) (question 4.a), or goes even further and means, for example, metadata associated with the data (question 4.b).
The deciding senate does not overlook the fact that the Supreme Court in Austria has already made a statement in its ruling of 17 December 2020, Zl. 6 Ob 138/20t, that a patient's right to be provided with a copy of the medical history arises in principle from Art. 15(3), Art. 12(5) of the GDPR. Recital 63 explicitly mentions data from patient records. The statement of the Supreme Court can be seen "only" in relation to medical records, as a particularly essential and sensitive form of personal data, or also as a statement of a general legal right to receive copies of processed personal data.
As far as can be seen, there is no case law of the Court of Justice of the European Union on the questions referred to in the ruling regarding the GDPR. Since the correct application of Union law, i.e. of Article 15(3), first sentence, of the GDPR, does not appear to the Federal Administrative Court to be so obvious for the reasons stated that there is no room for reasonable doubt (cf. ECJ, Judgment of 6 October 1982, Case 282/81, ECR 1982, 3415), the questions referred in the ruling are submitted pursuant to Article 267 TFEU with a request for a preliminary ruling.
VII. Information to the parties:
Pursuant to § 17 VwGVG in conjunction with § 38a AVG, if the administrative court has referred a question to the Court of Justice of the European Union for a preliminary ruling, it may, until receipt of the preliminary ruling, only take such actions or make such decisions and orders which cannot be influenced by the preliminary ruling or which do not conclusively settle the question and do not permit a stay. A formal stay of the proceedings by an independently contestable act is not provided for. The legal effects of section 38a AVG take effect ex lege at the time the application is filed and last until the preliminary ruling is received (cf. Hengstschläger/Leeb, AVG section 38a, RZ 12 [as of 1.4.2021, rdb.a]).
2) An appealability of the application for a preliminary ruling to the Court of Justice of the European Union is to be denied with regard to the fundamental competence of the Court of Justice of the European Union under Union law to decide on the entitlement to make a reference (cf. VwGH, 22.02.2001, Zl. 2001/04/0034 mwN, VwGH, 28.10.2008, Zl. 2008/05/0129).
European Case Law Identifier
ECLI:AT:BVWG:2021:W211.2222613.2.00
