On 15 December 2022, Advocate General Giovanni Pitruzzella issued his opinion in Case C- 487 /21 (Österreichische Datenschutzbehörde and CRIF), pending before the Court of Justice of the European Union (CJEU).
In brief, the Advocate General considers that in the light of the GDPR, the right of access does not confer on the data subject a general right to obtain a partial or complete copy of the document in which those data are contained. According to the Advocate General, that “copy” must be a faithful reproduction, in an intelligible form, of the data, in a tangible and permanent format, which allows the data subject to exercise his or her right of access in an effective manner.
Thus, the “copy” must enable the data subject:
- to be aware of all his or her data that are subject to processing, including those generated as a result of the processing,
- to verify the accuracy of the data and the lawfulness of the processing so that, if necessary, he/she can exercise other rights conferred by the GDPR.
The Advocate General also adds that the exact form that the “copy of the data” should take is determined by the specificities of each case. However, there is nothing to prevent the provision of the document containing those data to the extent that its provision would ensure the intelligibility of the data which are the subject of the request.
Note: On the one hand, this Opinion of the Advocate General further confirms and clarifies the view of the European Data Protection Board expressed in its Guidelines 1/2022 (i.e., first draft of 28 January 2022). On the other hand, the Romanian DPA has expressed on several occasions in practice that the notion of “copy of the personal data” in the GDPR should be interpreted as a copy of the support on which these data are stored, whether we are talking about written documents, video recordings from the video surveillance system or audio recordings from the call center. To the extent that the CJEU judges adhere to Advocate General Pitruzzella’s Opinion in the above case, given this court’s competence to interpret EU law, it is expected that the Romanian DPA will align its interpretation with that of the CJEU.
A press release is not yet available, but the full opinion is available here.
