Companies face various legal uncertainties when receiving data subject access requests (DSARs) pursuant to Article 15 of the European General Data Protection Regulation (GDPR).
In particular, it is unclear whether a data subject may claim the provision of a ‘copy’ of the summary of personal data processed or, by way of broad interpretation, a ‘copy’ of all data. The latter interpretation could require companies to provide data subjects with every relevant email, entire documents and extracts of databases containing references to their personal data.
Key takeaways from the AG’s opinion
On 15 December 2022, the Advocate General (AG) at the European Court of Justice (ECJ) Giovanni Pitruzzella delivered his opinion in an Austrian case currently pending before the ECJ (C-487/21). The case is the first preliminary ruling before the ECJ concerning the scope of the right to obtain copies in accordance with Article 15 (3) of the GDPR.
In the AG’s view, the term ‘copy’ should be, in principle, interpreted narrowly. The right to obtain a copy should not expand the right to obtain information about the personal data undergoing processing, according to Article 15 (1) of the GDPR. In individual cases, however, data controllers may still be obligated to provide entire documents to ensure the comprehensibility of the information provided to the data subject about their personal data undergoing processing.
Three key takeaways from the AG’s opinion are summarised below.
1. DSARs may cover other data generated by a controller’s processing
In the AG’s view, DSARs also cover other personal data generated by a controller’s processing. If the processing of personal data generates new information, which in turn relates to an identified or identifiable natural person, this other personal data also must be included in the response to a DSAR.
In the underlying case currently pending before the ECJ, a credit scoring agency had processed personal data to generate recommendations on the solvency of individuals. In the AG’s view, the copy provided to the data subject must include, not only the personal data used to generate the recommendation, but also the solvency recommendation itself.
2. In principle: no general right to obtain entire documents or extracts of databases
Contrary to some national courts’ and data protection authorities’ broad interpretation of the scope of DSARs, the AG argues GDPR Article 15 (3) does not provide data subjects with a general right to obtain documents and/or extracts of databases.
The term ‘copy’ in GDPR Article 15 (3) refers only to a copy of personal data undergoing processing. Data subjects, therefore, do not have a right to obtain information that cannot be qualified as ‘personal data undergoing processing’, and Article 15 (3) does not confer a right to obtain copies of documents containing personal data. Thus, entire documents do not qualify as ‘personal data undergoing processing’ simply because they contain individual references to personal data.
3. The provision of entire documents and/or database extracts may be required in certain cases
The term ‘copy’ in GDPR Article 15 (3) must be understood as a faithful reproduction of the personal data requested by the data subject in an intelligible form. In the AG’s view, the right to obtain a copy must be interpreted in light of the GDPR’s principle of transparency. As a result, in certain cases, the data controller may be required to transmit documents or extracts from databases if necessary to ensure the full transparency of the information transmitted to the data subject.
The AG emphasises that the analysis of the need to provide entire documents to ensure the comprehensibility of the information provided must be made on a case-by-case basis, based on the nature of the personal data and the respective DSAR.
Outlook for data subject access requests
Although AG opinions are not legally binding, they are usually followed by the ECJ. We expect that the ECJ’s judgement in this case will be rendered in the first half of 2023. Given that the AG has left some room for interpretation on the requirements to provide copies, it remains to be seen as to whether the ECJ will fully clarify the definition of a ‘copy’ in the context of DSARs.
