What is meant by the term “copy” under Art. 15 (3) GDPR, and how specifically should this term be interpreted in the context of requests for information? The ECJ addressed precisely this issue in a recent decision in Case C-487/21 What is a “copy” within .
What was it about? What is a “copy” within
In a request for a preliminary ruling, the Austrian Federal Administrative Court referred various questions to the ECJ regarding the scope and extent of Article 15(3) GDPR, but above all regarding the specific concept of a copy.
The background to this submission was a legal dispute between the credit agency CRIF GmbH ( we have already reported on this in another case) and a third party affected by CRIF’s services. The third party exercised its right under Art. 15 GDPR against CRIF and requested information about its personal data. Furthermore, switzerland business fax list pursuant to Art. 15 (3) GDPR, it requested a copy of the documents containing its data.
CRIF complied with this request for information, including the request for a copy, by sending the person requesting the information a list in aggregate form containing the personal data concerning him that were subject to processing.
Since the information seeker considered the copy provided in aggregated form to be insufficient, he contacted the competent supervisory authority and filed a complaint. The supervisory authority disagreed with the information seeker’s view, resulting in a negative decision. The information seeker subsequently appealed against this decision ( represented by noyb ), and the Federal Administrative
Interpretation of the ECJ
In its answer, the ECJ summarised questions 1 to 3 and made the following findings:
Firstly, it was once again clearly stated that the term “information,” which itself forms part of the definition of “personal data,” entails a broad interpretation. The ECJ clarified that this refers to all types of information, both objective and subjective, the whatsapp connection: empowering instant communication including opinions or assessments, provided that this information relates to the person in question. Accordingly, the term “personal data” includes not only “data collected and retained by the controller, but also any information relating to an identified or identifiable person resulting from the processing of personal data, such as an assessment of their ability or willingness to pay” (para. 26) .
From this assumption and the broad interpretation of “personal data” it follows that data subjects must be able to recognise and evaluate a faithful and accurate reproduction of their own data processing operations by receiving a corresponding copy within the meaning of Art. 15 (3) Sentence 1 GDPR in order to then possibly exercise further data subject rights.
Broad understanding of “copy”
The ECJ’s findings in this judgment demonstrate that, when responding to requests for information in which data subjects also request a copy of their processed data, united states business directory it is sometimes no longer possible to “merely” provide information seekers with an aggregated list of their data if this does not clearly reveal the context of the data processing. Rather, the “copy” must reflect the logical context of the specific data processing operations in order to give the data subject the opportunity to exercise further data subject rights.