Under Article 15(3) GDPR, you can request a "copy" of your processed personal data. The CJEU explains in Case C-487/21 what such a copy should include. This can include copies of the complete documents containing personal data. 

CRIF received a request from one of its customers to provide copies of emails and database extracts containing his personal data. CRIF sent him a list of his processed personal data in aggregated form, but not the requested documents. The customer filed a complaint with the Austrian Data Protection Authority. He argued that CRIF had not fully complied with his request. The Austrian authority rejected the complaint, after which the case went to the Austrian court. The latter asked the CJEU to clarify the concept of a "copy" within the meaning of Article 15(3) GDPR.

The CJEU rules that the right of inspection under Article 15(3) GDPR means that the data subject has the right to a "faithful reproduction" of all his or her personal data being processed. As a controller, you do not have a general obligation under Article 15(3) GDPR to provide complete copies of documents. You can then suffice with an overview of the personal data processed, on the basis of which the data subject can verify that they are accurate and lawfully processed. So far so good for CRIF.

However, the CJEU further ruled that in certain cases, a data subject does have the right to a copy of complete documents or database extracts containing his or her personal data (or extracts thereof), if their provision is "essential" to enable him or her to effectively exercise the rights under the GDPR (e.g. the right to correction). This is the case, for example, if it is necessary to put the personal data in their context in order to understand them. Whether this was so in the case of CRIF remains to be seen. It is advisable for data controllers to anticipate this (sometimes broad) right of inspection in their records. 

Lisa Peek

29 June 2023