Judgment;Abstract — ECLI:EU:C:2023:811
Date: 2023-10-26
Language of the case: German
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary C-307/22 – 1 
Case C-307/22 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
10 May 2022 
Referring court: 
Bundesgerichtshof (Germany) 
Date of the decision to refer: 
29 March 2022 
Defendant and appellant on a point of law: 
FT 
Applicant and respondent in the appeal on a point of law: 
DW 
  
Subject matter of the main proceedings 
Action brought by DW seeking the provision, free of charge, of a copy of the 
medical records concerning him which are held by the defendant dentist, FT. 
Subject matter and legal basis of the request 
Interpretation of EU law, in particular Article 15(3) of Regulation (EU) 2016/679; 
the request for a preliminary ruling is made on the basis of Article 267 TFEU 
Questions referred for a preliminary ruling 
1. Must the first sentence of Article 15(3) of the General Data Protection 
Regulation (GDPR), read in conjunction with Article 12(5) thereof, be interpreted 
as meaning that the controller (in the present case: the doctor providing treatment) 
is not obliged to provide the data subject (in the present case: the patient), free of 
charge, with a first copy of his or her personal data processed by the controller 
where the data subject does not request the copy in order to pursue the purposes 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-307/22 
 
2  
referred to in the first sentence of recital 63 of the GDPR, namely to become 
aware of the processing of his or her personal data and to be able to verify the 
lawfulness of that processing, but pursues a different purpose – one which is not 
related to data protection but is legitimate (in the present case: to verify the 
existence of claims under medical liability law)? 
2. If Question 1 is answered in the negative: 
(a) In accordance with Article 23(1)(i) of the GDPR, can a national provision of 
a Member State adopted prior to the entry into force of the GDPR also be 
regarded as a restriction of the right to be provided, free of charge, with a copy of 
the personal data processed by the controller, as provided for in the first sentence 
of Article 15(3) of the GDPR, read in conjunction with Article 12(5) thereof? 
(b) If Question 2(a) is answered in the affirmative: Must Article 23(1)(i) of the 
GDPR be interpreted as meaning that the rights and freedoms of others, as 
referred to therein, also include their interest in being relieved of the costs 
associated with the provision of a copy of data in accordance with the first 
sentence of Article 15(3) of the GDPR and other expenses incurred in making the 
copy available? 
(c) If Question 2(b) is answered in the affirmative: In accordance with 
Article 23(1)(i) of the GDPR, can national legislation which, in the context of the 
doctor-patient relationship, provides that the doctor always has a claim for 
reimbursement of expenses against the patient, irrespective of the specific 
circumstances of the individual case, where the doctor provides the patient with a 
copy of the patient’s personal data from the patient’s medical records be regarded 
as a restriction of the obligations and rights arising from the first sentence of 
Article 15(3) of the GDPR, read in conjunction with Article 12(5) thereof? 
3. If Question 1 is answered in the negative and Question 2(a), 2(b) or 2(c) is 
answered in the negative: In the context of the doctor-patient relationship, does 
the entitlement under the first sentence of Article 15(3) of the GDPR include 
entitlement to be provided with copies of all parts of the patient’s medical records 
containing the patient’s personal data, or does it extend only to the provision of a 
copy of the patient’s personal data as such, with the doctor who processes the data 
deciding the manner in which he or she compiles the data for the patient 
concerned? 
Provisions of EU law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) (‘the GDPR’), Article 12(5), the 
first and third sentences of Article 15(3) and Article 23(1), in particular point (i) 
thereof; recital 63, in particular the first sentence thereof 
FT 
 
3 
Provisions of national law relied on 
Bürgerliches Gesetzbuch (German Civil Code; ‘the BGB’) 
Paragraph 630f (‘Documentation of treatment’) 
‘(1) The person providing treatment is obliged to keep medical records in paper 
form or electronically for the purpose of documentation in direct temporal 
connection with the treatment. … 
(2) The person providing treatment is obliged to record in the medical records all 
measures which, from a professional point of view, are essential for the current 
and future treatment, and the results of those measures, in particular the patient’s 
history, diagnoses, examinations, results of examinations, findings, therapies and 
the effects thereof, procedures and the effects thereof, consents and any 
explanations given. Doctors’ letters shall be included in the medical records. 
(3) The person providing treatment shall retain the medical records for a period of 
ten years after completion of the treatment, unless other retention periods exist 
under other provisions.’ 
Paragraph 630g (‘Access to medical records’) 
‘(1) Upon request, the patient shall be granted immediate access to the complete 
medical records concerning him or her, unless such access is precluded by 
significant treatment-related reasons or other significant rights of third parties. … 
(2) The patient may also request electronic copies of the medical records. He or 
she must reimburse the person providing treatment with the costs incurred. 
…’ 
Succinct presentation of the facts and procedure in the main proceedings 
1 DW requests that FT provide him, free of charge, with a copy of all medical 
records concerning him that are being held by FT. FT, who is based in Germany, 
is a dentist. DW was undergoing treatment with her. He takes the view that FT’s 
services were rendered incorrectly. FT takes the view that she is required to 
provide a copy of the medical records only if the patient reimburses the costs. 
2 The Amtsgericht (Local Court) upheld DW’s action. The Landgericht (Regional 
Court) dismissed FT’s appeal on the merits. The Regional Court took the view 
that, in the present case, the fact that DW requested the information in order to 
verify whether he has claims under medical liability law does not preclude his 
entitlement arising from Article 15 of the GDPR. By her appeal on a point of law 
before the referring court, FT maintains her form of order seeking dismissal of the 
action. The success of the appeal on a point of law hinges on whether the court 
which ruled on the appeal on the merits erred in law in finding that – as asserted 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-307/22 
 
4  
by DW – the action is well-founded under the provisions of the GDPR. In order to 
determine whether that is the case, an interpretation of provisions of the GDPR, in 
particular Article 15(3) thereof, is required. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
3 The referring court states that, under the provisions of national law, namely 
Paragraphs 630f and 630g of the BGB, FT is not obliged to provide DW with 
copies of the medical records concerning him free of charge. 
4 However, DW’s entitlement to have them provided free of charge could arise 
directly from Article 15(3) of the GDPR, read in conjunction with Article 12(5) 
thereof. The GDPR is applicable to the present case ratione temporis and ratione 
materiae. It follows from the first and second sentences of Article 15(3) of the 
GDPR, read in conjunction with Article 12(5) thereof, that the controller must, in 
principle, provide the first copy of the personal data which are the subject of the 
processing free of charge. 
Question 1 
5 By its first question, the referring court seeks to ascertain whether the first 
sentence of Article 15(3) of the GDPR, read in conjunction with Article 12(5) 
thereof, must be interpreted as meaning that the controller is not obliged to 
provide the data subject, free of charge, with a first copy of his or her personal 
data processed by the controller where the data subject does not request the copy 
in order to pursue the purposes referred to in the first sentence of recital 63 of the 
GDPR, namely to become aware of the processing of his or her personal data and 
to be able to verify the lawfulness of that processing, but pursues a different 
purpose – one which is not related to data protection but is legitimate (in the 
present case: claims under medical liability law). 
6 According to one view, entitlement to the provision of a copy cannot be based on 
the first sentence of Article 15(3) of the GDPR, read in conjunction with 
Article 12(5) thereof, where interests other than those pertaining to data protection 
law are pursued – that is to say where, as in the present case, the interest in 
obtaining information is based on being able to prepare the assertion of claims 
under medical liability law. 
7 The referring court has doubts as to whether that view is correct. It is true that the 
rights of the data subject and the obligations of the controller under Article 15 of 
the GDPR serve the purpose of enabling the data subject to become aware of the 
data processing and to verify the lawfulness of that processing (see also judgment 
of the Court of 20 December 2017, Nowak, C-434/16, EU:C:2017:994, 
paragraph 57, concerning Article 12(a) of Directive 95/46/EC of the European 
Parliament and of the Council of 24 October 1995 on the protection of individuals 
with regard to the processing of personal data and on the free movement of such 
FT 
 
5 
data). However, according to the wording of Article 15 of the GDPR, the 
existence of the rights and obligations regulated therein does not depend on the 
data subject having grounds corresponding to the protective purpose referred to 
above and does not require him or her to justify his or her request for the provision 
of information and a copy. 
8 The referring court takes the view that the EU legislature therefore intended to 
leave, in principle, the data subject free to decide whether and on what grounds he 
or she is to assert his or her rights under Article 15 of the GDPR. That view is also 
supported by the fact that the provision of information and a copy on the basis of 
Article 15 of the GDPR enables the data subject to become aware of the data 
processing and to verify the lawfulness of that processing even if he or she has 
requested it for other reasons, that is to say, the purpose of the provision can 
ultimately be achieved irrespective of the data subject’s grounds. Therefore, in the 
view of the referring court, a request for the provision of a copy of the processed 
data on the basis of Article 15(3) of the GDPR – even if it is not motivated by the 
protective purpose of the provision – must be regarded as being neither manifestly 
unfounded nor excessive within the meaning of the second sentence of 
Article 12(5) of the GDPR. 
9 Nor does the request constitute an abuse of rights. It is true that, in its judgment of 
26 February 2019, N Luxembourg 1, (C-115/16, C-118/16, C-119/16 and 
C-299/16, EU:C:2019:134, paragraphs 98, 102, 124), the Court stated that it 
follows from the general legal principle according to which EU law cannot be 
relied on for abusive or fraudulent ends that a Member State must refuse to grant 
the benefit of the provisions of EU law where they are relied upon not with a view 
to achieving the objectives of those provisions but with the aim of benefiting from 
an advantage in EU law although the conditions for benefiting from that 
advantage are fulfilled only formally. Proof of an abusive practice requires, first, a 
combination of objective circumstances in which, despite formal observance of 
the conditions laid down by the EU rules, the purpose of those rules has not been 
achieved and, second, a subjective element consisting in the intention to obtain an 
advantage from the EU rules by artificially creating the conditions laid down for 
obtaining it. However, the referring court takes the view that those two conditions 
from the abovementioned judgment are not fulfilled merely because DW’s request 
for a copy of the processed data in accordance with the first sentence of 
Article 15(3) of the GDPR is not motivated by the protective purpose of the 
provision. 
10 Nor does anything to the contrary follow, in the view of the referring court, from 
the judgment of the Court of 17 July 2014 in YS and Others (C-141/12 and 
C-372/12, EU:C:2014:2081, paragraphs 45 and 46). The referring court takes the 
view that that case was concerned with determining the object of the right to 
information, taking into account its protective purpose, and specifically whether a 
right to information under data protection law could cover the legal analysis 
concerning the granting of a residence permit, contained in a draft administrative 
document. The present case, by contrast, concerns the question as to whether the 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-307/22 
 
6  
fact that the grounds of the application are not related to the protective purpose 
can have an influence on the justification of the request. 
Question 2 
11 By Questions 2(a) to (c), the referring court seeks to ascertain how the cost regime 
to the detriment of the patient, as provided for in national law, is to be interpreted 
in the light of the GDPR. To that end, an interpretation of Article 23(1) of the 
GDPR is required. According to this provision, Member State law to which the 
data controller is subject may restrict by way of a legislative measure the scope of, 
inter alia, the obligations and rights provided for in Articles 12 to 22 of the GDPR 
when such a restriction respects the essence of the fundamental rights and 
freedoms and is a necessary and proportionate measure to safeguard one of the 
objectives listed in Article 23(1)(a) to (j) of the GDPR. 
12 In that respect, FT relies on the purpose of protecting the rights and freedoms of 
other persons which is referred to in Article 23(1)(i) of the GDPR and submits that 
the cost regime in the second sentence of Paragraph 630g(2) of the BGB is a 
necessary and proportionate measure to safeguard the legitimate interests of the 
(dental) practitioner providing treatment. 
Question 2(a) 
13 This question seeks clarification as to whether national provisions which – like 
Paragraph 630g of the BGB in the present case – were adopted prior to the entry 
into force of the GDPR must also be assessed against the abovementioned 
provisions of the GDPR. 
Question 2(b) 
14 In the event that Question 2(a) is answered in the affirmative, that is to say, that 
Paragraph 630g of the BGB is to be assessed against, inter alia, Article 23(1) of 
the GDPR, an interpretation of, specifically, Article 23(1)(i) is required. 
15 The cost regime in Paragraph 630g of the BGB takes into account the economic 
interests of the person providing treatment and also – in the view taken by FT – 
the consideration that patients should be prevented from requesting their records 
without good reason. This raises the question as to whether Article 23(1)(i) of the 
GDPR must be interpreted as meaning that the rights and freedoms of others, as 
referred to therein, also include their interest in being relieved of the costs 
associated with the provision of a copy of data in accordance with the first 
sentence of Article 15(3) of the GDPR and other expenses incurred in making the 
copy available. 
16 However, it is disputed whether the concept of the rights and freedoms of others 
within the meaning of Article 23(1)(i) GDPR can also cover economic interests. 
FT 
 
7 
Question 2(c) 
17 If the second sentence of Paragraph 630g(2) of the BGB were to be regarded as a 
permissible restriction of the obligations of the person providing treatment vis-à-
vis the patient which arise from the first sentence of Article 15(3) of the GDPR, 
read in conjunction with the first sentence of Article 12(5) thereof, this would 
result in the patient always having to bear the costs of the copy of the data to be 
provided by the person providing treatment in accordance with the first sentence 
of Article 15(3) of the GDPR, including with regard to the first copy, irrespective 
of the specific circumstances of the individual case, that is to say irrespective of, 
in particular, the amount of the costs actually associated with the provision of the 
copy. 
18 This leads to Question 2(c), as to whether such a categorical exclusion – in the 
present case: for the relationship between the person providing treatment and the 
patient as regards the provision of patient records – can be a necessary and 
proportionate measure within the meaning of Article 23(1)(i) of the GDPR. In 
particular, the referring court seeks clarification as to whether the restriction of the 
rights of the data subject imposed by Paragraph 630g of the BGB is within the 
limits of the discretion granted to the national legislature by Article 23(1) of the 
GDPR. 
19 The referring court takes the view that it follows from the requirement of 
necessity and proportionality that a regime establishing a restriction under 
Article 23(1) of the GDPR must in principle leave room for taking into account 
the circumstances of the individual case. 
20 However, this is not the case with the second sentence of Paragraph 630g(2) of the 
BGB. That provision contains a full categorical exclusion (in relation to the 
provision of treatment records). The referring court takes the view that that 
provision is not justified by the particular effort required on the part of the person 
providing treatment. It states that the EU legislature also had the economic 
interests of the controller in mind: only the provision of a first copy may be 
requested free of charge; for any further copies requested by the data subject, a 
reasonable fee based on administrative costs may be charged in accordance with 
the second sentence of Article 15(3) of the GDPR. 
Question 3 
21 DW’s request for legal protection is directed at the provision of a copy of all 
medical records concerning him, that is to say, a copy of his ‘medical records’ 
within the meaning of both Paragraph 630f of the BGB and Article 3(m) of 
Directive 2011/24/EU of the European Parliament and of the Council of 9 March 
2011 on the application of patients’ rights in cross-border healthcare. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-307/22 
 
8  
22 That request for legal protection can be covered only by the first sentence of 
Article 15(3) of the GDPR in so far as the medical records contain personal data 
of the applicant. 
23 The question as to the content and scope of the obligation to provide a copy of the 
personal data undergoing processing, as laid down in the first sentence of 
Article 15(3) of the GDPR, is disputed and is already the subject of a pending 
request for a preliminary ruling by the Bundesverwaltungsgericht (Federal 
Administrative Court, Austria) (order for reference of 9 August 2021, Case 
C-487/21). That dispute becomes relevant to the decision to be given in the 
present case if the claim asserted by DW is not to be dismissed already on the 
basis of the considerations covered by Questions 1 and 2. 
24 According to one view, although Article 15(3) of the GDPR gives rise to 
entitlement to a copy of the data about which information is to be provided 
pursuant to Article 15(1) of the GDPR, it does not, in principle, give rise to 
entitlement to the provision of copies of certain documents or all individual data 
processed. In order to fulfil the purpose of the right of access referred to in the 
first sentence of recital 63, which is to enable the data subject to become aware of 
the processing of his or her personal data and to verify the lawfulness of that 
processing, a summary of the data processed, which is structured, where 
appropriate, may even be more appropriate than the provision of a copy of all, 
possibly redundant, individual data. The controller’s obligation under the first 
sentence of Article 15(3) of the GDPR cannot go so far as to require it to provide 
a copy of every document containing an item of personal data – such as the data 
subject’s name, for example. That view might also be supported by the judgment 
of the Court of 17 July 2014 in YS and Others (C-141/12 and C-372/12, 
EU:C:2014:2081, paragraph 45 and paragraphs 59 and 60). 
25 According to another view, under the first sentence of Article 15(3) of the GDPR, 
the controller must in principle provide the data subject with a copy of all personal 
data processed, in the form as held by the controller. The patient would therefore 
have to be provided with a copy of all medical records concerning him or her in so 
far as they contain his or her personal data. A list of the data would not be 
sufficient. 
26 That view is based on the fact that the data subject’s entitlement to a copy is a 
right independent of the right to information under Article 15(1) of the GDPR and 
is therefore not systematically limited to the required content of the information 
under that provision. The objectives of transparency and enabling the data subject 
to verify lawfulness which are referred to in recital 63 could not be achieved in the 
same way with a mere summary or overview of the personal data processed. The 
judgment of the Court of 17 July 2014 in YS and Others (C-141/12 and C-372/12, 
EU:C:2014:2081) concerning the interpretation of Article 12(a) of Directive 95/46 
cannot be taken as the basis, as that provision does not contain a right to a copy.