On 4 May 2023, the EU Court of Justice (ECJ) issued its judgment in Case C-487/21 (F.F. v Österreichische Datenschutzbehörde and CRIF) on how to exercise the right to have copies of personal data as an expression of the more general right of access provided under Article 15 GDPR. Specifically, the ECJ held that this right entails the right to obtain copies of extracts of documents or even entire documents or extracts of databases containing personal data, to the extent that the provision of such copies is essential to enable data subjects to effectively exercise their rights. From this perspective, the ECJ clarified that the term "copy" refers to the personal data contained in the document, and thus data controllers are not required to provide the document itself in which such data are contained.
Originally published by May, 2023
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.