Information;Order — ECLI:EU:C:2024:458
Date: 2024-05-27
Language of the case: Croatian
Court formation: Sixth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Croatia

Translation C-312/23 – 1 
Case C-312/23 
Request for a preliminary ruling  
Date lodged: 
22 May 2023 
Referring court: 
Upravni sud u Zagrebu (Croatia) 
Date of the decision to refer: 
2 May 2023 
Applicant: 
Addiko Bank d.d. 
Defendant: 
Agencija za zaštitu osobnih podataka 
  
THE REPUBLIC OF CROATIA 
UPRAVNI SUD U ZAGREBU (Administrative Court, Zagreb, Croatia) 
[…] 
COURT OF JUSTICE OF THE EUROPEAN UNION 
REQUEST FOR A PRELIMINARY RULING  
Referring court  
1 […] Upravni sud u Zagrebu (Administrative Court, Zagreb) […] 
Exact names of the parties to the main proceedings  
2 Applicant: Addiko Bank d.d., Zagreb […]. The Applicant is represented by […]. 
3 Defendant: Agencija za zaštitu osobnih podataka (Personal Data Protection 
Agency), Zagreb […] 
EN 
REQUEST FOR A PRELIMINARY RULING OF 2. 5. 2023 – CASE C-312/23 
 
2  
Subject matter of the main proceedings  
4 The subject matter of the administrative proceedings before the Upravni sud u 
Zagrebu (Administrative Court, Zagreb) is an assessment of the legality of the 
decision of the defendant […] of 25 February 2020, which found, in point 1 of its 
operative part, that the applicant, by preventing exercise of the right to access 
personal data, was in breach of Article 15(3) of the General Data Protection 
Regulation. These personal data were credit-related documentation in connection 
with 2 577 requests received from borrowers of repaid loans in the period from 
25 May 2018 to 30 April 2019, which were processed in connection with credit 
agreements in Swiss francs (CHF) with a variable interest rate, which the 
borrowers had concluded with Hypo Alpe Adria Bank d.d. of Zagreb, […] as the 
legal predecessor of the applicant. In point 2 of the decision on the infringement 
of the rights of data subjects referred to in Article 15(3) of the General Data 
Protection Regulation, namely for the serious breach described in point 1 of the 
operative part of the decision, in accordance with Article 83(2) and (5) of the 
General Data Protection Regulation, an administrative fine of HRK 1 100 000.00 
(in words: one million, one hundred thousand kunas) was imposed on the 
applicant, and it was found that the applicant was required to pay the imposed 
administrative fine into the State budget account specified in the decision within 
15 days of the decision becoming final. Point 3 of the operative part of the 
decision stated that if the applicant, within 15 days of the decision becoming final, 
failed to pay the administrative fine imposed, the Personal Data Protection 
Agency would inform the Područni ured Porezne uprave Ministarstva financija 
(the regional branch of the Tax Administration of the Ministry of Finance) in 
whose region the headquarters of the said company is located, in order to enforce 
an administrative fine in accordance with the provisions on compulsory 
enforcement of taxes in accordance with Article 46(2) of the Zakon o provedbi 
Opće uredbe o zaštiti podataka (the Law Implementing the General Data 
Protection Regulation). Point 4 of the operative part of the decision states that the 
applicant was required to provide proof of payment to the Personal Data 
Protection Agency after making the payment. 
Relevant facts  
5 The Agencija za zaštitu Osobnih podataka (Personal Data Protection Agency) 
(‘the Agency’) was contacted by a number of natural persons with complaints in 
which they allege that Addiko bank d.d. (‘the Bank’) did not allow them to 
exercise the right to access personal data, namely that it refused to provide the 
requested credit-related documentation, which contains their personal data 
regarding credit agreements concluded in Swiss francs (CHF), which had been 
fully repaid, and which had been concluded with Hypo Alpe Adria Bank d.d. as 
the legal predecessor of the Bank. 
6 The natural persons (borrowers) wished to obtain credit-related documentation 
from the Bank (credit agreements, repayment schedules, information on changes 
ADDIKO BANK 
 
3 
in interest rates, accounting documents, and so forth) regarding their credit 
agreements. 
7 In some of the requests, the purpose for which the credit-related documentation 
was requested was explicitly stated (for example, in order to file a lawsuit, 
institute court proceedings, and so forth), while other requests did not specify the 
purpose of applying for the credit-related documentation. 
8 According to the Bank’s details, in the period between 25 May 2018 and 30 April 
2019, there were 2 603 requests from customers for the provision of credit-related 
documentation. 
9 The Bank dismissed the requests received from borrowers for credit-related 
documentation, citing, inter alia, the termination of the relationship of obligation 
upon full repayment of the loan, claiming that the creditor’s obligation applies 
during the term of the credit agreement and not after its termination. 
10 The Bank has a statutory obligation to retain credit-related documentation, which 
continues even after the termination of the contractual relationship. The Bank 
stores customers’ personal data, in accordance with its legal obligations, in the 
following databases: in the HIBIS database – a trading system in which all 
customer registration data related to the services used by the customer are kept, 
and in which the borrower’s book balance is also visible both in terms of the 
account balance and the loan balance, as well as in the ALFRESCO database – a 
database of scanned documents (all credit-related documentation). 
11 The Agency determined the exact number of requests from data subjects (2 577) 
by subtracting the number of requests in which the Agency had already issued 
decisions ordering the Bank to enable the applicants to exercise their rights and 
provide the requested personal data from that credit-related documentation (26) 
from the total number of submitted applications (2 603). 
12 The Agency imposed an administrative fine on the Bank, as, despite the fact that 
the Agency had issued decisions ordering the Bank to release the personal data in 
26 cases, the Bank continued the practice of rejecting requests for personal data 
related to loan agreements concluded by the applicants and, therefore, the 
imposition of less stringent sanctions did not prompt the Bank to follow personal 
data protection provisions. 
Provisions of EU law in respect of which an interpretation is sought 
13 Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (‘the General Data Protection Regulation’) (OJ 2016 L 119, p. 1), 
recital 63 and Article 15. 
REQUEST FOR A PRELIMINARY RULING OF 2. 5. 2023 – CASE C-312/23 
 
4  
Provisions of national law relied on 
14 Zakon o provedbi Opće uredbe o zaštiti podataka (Law Implementing the General 
Data Protection Regulation) (Narodne novine [Official Journal of Croatia], 
No 42/18), Articles 34, 36, 44, 45 and 46. 
Article 34 
(1) Anyone who believes that one of the rights guaranteed by this Law and by 
the General Data Protection Regulation has been infringed in his or her regard 
may submit an application to the Agency for a declaration that that right has been 
infringed. 
(2) Infringements are decided upon by the Agency by way of a decision. 
(3) A decision of the Agency is an administrative act. 
(4) An appeal against a decision of the Agency is not admissible, but 
administrative court proceedings may be initiated before the competent 
administrative court on the basis of a complaint. 
Conducting inspections 
Article 36 
(1) Authorised employees of the Agency, independently, and in specific 
situations also in the presence of personnel from the supervisory authority 
delegating the employee (‘authorised individuals’), may conduct announced or 
unannounced inspections. In the case of an unannounced inspection, the person in 
relation to whom the inspection is being carried out, namely the controller or 
processor, shall be informed on site and at the time of the inspection. 
(2) Before commencing an inspection pursuant to paragraph 1 of this article, the 
authorised individuals shall identify themselves by presenting their official 
identification and the inspection order. 
(3) If it is anticipated that the inspection will be disrupted due to resistance, the 
Agency shall submit a written request to the ministry responsible for internal 
affairs for assistance in carrying out these inspection-related activities. 
(4) On the basis of the Agency’s request, the ministry responsible for internal 
affairs is required, in accordance with specific provisions, to provide assistance in 
conducting the inspection as referred to in paragraph 2 of this article. 
(5) The inspection order referred to in paragraph 1 of this article shall be issued 
by the President of the Agency. 
Article 44 
ADDIKO BANK 
 
5 
(1) For a breach of the provisions of this Law and of the General Data 
Protection Regulation, the Agency shall impose administrative fines in accordance 
with Article 83 of the General Data Protection Regulation. 
(2) In the case of the imposition of an administrative fine on a legal person 
under public law or on a legal person providing public services, the imposed 
administrative fine must not jeopardise the exercise of public powers or the 
provision of public services. 
Article 45 
(1) Administrative fines shall be imposed by way of a decision. 
(2) The decision referred to in paragraph 1 of this article shall determine the 
amount and method of payment of the administrative fine. The decision may 
stipulate that the administrative fine is payable in instalments. 
(3) When, in accordance with Article 83 of the General Data Protection 
Regulation, administrative fines are imposed in addition to the measures referred 
to in Article 58(2)(a) to (h) and (j) of the General Data Protection Regulation, the 
decision on the administrative fine shall be issued after the decision imposing the 
measure becomes final. 
(4) An appeal against the decision referred to in paragraph1 of this article shall 
not be admissible, but administrative court proceedings may be initiated before the 
competent administrative court. 
(5) The Agency shall establish criteria for instalment payments and conditions 
for the revocation of instalment payments of the administrative fine, taking into 
account the amount of the administrative fine. The criteria shall be published in 
the Narodne novine (Official Gazette) and on the Agency’s website. 
Article 46 
(1) An administrative fine must be paid within 15 days from the date on which 
the decision by which it was imposed becomes final. 
(2) If the party on which the administrative fine is imposed fails to pay that fine 
within the specified period or after the due date for final instalment, if payment in 
instalments was permitted, the Agency shall notify, to that effect, the Područni 
ured Porezne uprave Ministarstva financija (regional branch of the Tax 
Administration of the Ministry of Finance) responsible for the area in which the 
place of residence or registered office of the party on which the administrative 
fine was imposed is located, for the enforcement of the administrative fine in 
accordance with the provisions on enforced tax collection. 
(3) The administrative fine shall be paid into the State budget. 
REQUEST FOR A PRELIMINARY RULING OF 2. 5. 2023 – CASE C-312/23 
 
6  
(4) By derogation from paragraph 2 of this article, no interest is to be charged 
on an outstanding and unpaid administrative fine. 
15 Zakon o kreditnim institucijama (Law on Credit Institutions) (Narodne novine, 
No 159/13, 19/15, 102/15, 15/18, and 70/19), Article 160). 
Accounting documents  
Article 160 
(1) Credit institutions are required to prepare, monitor and retain accounting 
documents in accordance with applicable regulations and professional standards. 
(2) By derogation from paragraph 1 of this article, credit institutions are 
required to retain the following for at least 11 years: 
1. documents related to opening and closing of accounts, as well as those relating 
to changes recorded on payment accounts and deposits; 
2. documents related to other changes not covered by point 1 of this paragraph on 
the basis of which data have been entered in the commercial accounts of the credit 
institution; and 
3. agreements and other documents related to the establishment of an economic 
relationship. 
(3) It is assumed that the period referred to in paragraph 2 of this article is the 
period after the passage of the year in which the economic change occurred or in 
which the accounting documents were prepared. If the documents relate to long-
term transactions, such documents shall be retained for the duration of the 
economic relationship and for at least 11 years after the end of the year in which 
the economic relationship ceased. 
(4) Credit institutions are required to retain commercial accounts for at least 
11 years starting from the last day of the financial year to which those commercial 
books pertain. 
Relevant national case-law  
16 In more than 30 cases, final judgments have confirmed the legality of the 
decisions made by the Agency. These judgments stated that the requests of data 
subjects (the Bank’s customers) regarding the determination of an infringement of 
the right to personal data protection were justified. They also stated that the Bank 
had breached Article 15(3) of the General Data Protection Regulation, and the 
Bank was ordered to allow the customers to exercise their right to access credit-
related information, namely their personal data. In all these administrative court 
proceedings initiated by the Bank against the Agency, the actual legal question in 
dispute was whether, on the basis of Article 15(3) of the General Data Protection 
ADDIKO BANK 
 
7 
Regulation, a customer of the Bank has the right to obtain copies of credit-related 
documentation kept by the Bank after the termination of the loan agreement. In 
these cases, the Visoki upravni sud Republike Hrvatske (Administrative Court of 
Appeal, Croatia) answered this question in the affirmative, to the effect that the 
Bank is required to provide copies of documents containing personal data, and in 
this way to provide access to personal data. The Visoki upravni sud 
(Administrative Court of Appeal) also expressed the view that the controller does 
not have the right to inquire into the reasons why the data subject is requesting 
personal data/copies of personal data, because the data subject is not required to 
state the purpose of requesting his or her personal data in order to exercise the 
right of access to such data. 
The essential arguments of the parties in the main proceedings  
Arguments of the Agency 
17 The Agency sets out its view that credit-related documentation containing 
personal data of a borrower, which the Bank – as the controller – continues to 
process (or stores in accordance with obligations arising under specific 
regulations) is deemed to be personal data within the meaning of Article 4(1) of 
the General Data Protection Regulation. It considers the submitted requests for the 
provision of documentation to be requests for the right of access to data in 
accordance with Article 15(3) of the General Data Protection Regulation, and that 
the right of access to personal data under Article 15 of the General Data Protection 
Regulation is not limited to the duration of the contractual relationship arising 
from the loan agreement. It is also of the view that the statutory obligation to 
retain credit-related documentation continues even after the termination of the 
contractual (economic) relationship, and that the data subject is not required to 
state the purpose for which he or she is requesting access to the data and to obtain 
copies (since these are his or her own data and not the data of the applicant as the 
controller). It further considers that the duration of the obligation to retain data 
and documentation, including documentation related to agreements, is 11 years in 
accordance with the Zakon o kreditnim institucijama (the Law on Credit 
Institutions), that accounting documentation is to be retained for 10 years in 
accordance with the Opći porezni zakon (the Tax Ordinance), and that parts of the 
documentation are to be retained in accordance with the timeframes specified in 
the Zakon o računovodstvu (the Law on Accounting), the Zakon o platnom 
prometu (the Law on Payment Transactions), and the Zakon o sprečavanju pranja 
novca i financiranju terorizma (the Law combating Money Laundering and 
Terrorist Financing). It states that this provides the legal basis for processing 
(storing) the personal data of data subjects (the Bank’s customers) within the 
meaning of Article 6(1)(c) of the General Data Protection Regulation. On the 
basis of these assumptions, the Agency concluded that the Bank – as the 
controller – was required to act in accordance with the provisions of the General 
Data Protection Regulation and to ensure the right of access to personal data, 
REQUEST FOR A PRELIMINARY RULING OF 2. 5. 2023 – CASE C-312/23 
 
8  
which includes providing a copy of credit-related documentation in accordance 
with Article 15(3) of the General Data Protection Regulation. By rejecting the 
requests of 2 577 data subjects, the Bank had committed an egregious breach of 
the General Data Protection Regulation, which prompted the Agency to impose an 
administrative fine of HRK 1 100 000.00 on it. 
18 The Agency is of the opinion that Article 15 of the General Data Protection 
Regulation regulates the rights of data subjects regarding access to personal data 
in a different way from Article 12 of Directive 95/46/EC. Article 12 of Directive 
95/46/EC concerned the provision of information that was regulated differently 
from the copy of personal data as referred to in Article 15(3) of the General Data 
Protection Regulation. The Agency is also of the opinion that the case-law of the 
Court of Justice of the European Union (‘the Court of Justice’) referred to by the 
Bank is not applicable after the entry into force of the General Data Protection 
Regulation, and that, pursuant to Article 15(3) of the General Data Protection 
Regulation, the term ‘copy’ refers specifically to a copy of a document containing 
the personal data of the data subject, which is supported by paragraph 3 of the 
abovementioned article of the General Data Protection Regulation. This explicitly 
states that a reasonable fee may be charged to the data subject for access to 
personal data or for obtaining a copy. A question arises in this regard as to the 
intentions of the author of the General Data Protection Regulation: why regulate 
the controller charging a reasonable fee for obtaining a copy, if it were referring to 
the traditional provision of information on the processing of personal data? The 
Directive contained a clear provision regarding the obtaining of information, 
which was replaced by the confirmation concerning the processing of personal 
data in accordance with Article 15(1) of the General Data Protection Regulation 
upon its entry into force. The confirmation regarding the processing of personal 
data referred to in the abovementioned paragraph is generally free of charge in 
accordance with Article 12(5) of the General Data Protection Regulation, while 
Article 15(3) specifically highlights the fact that the controller may charge a 
reasonable fee for obtaining a copy of personal data. It is, therefore, clear that it is 
specifically referring to copies of, inter alia, personal data/documents containing 
personal data, because it would be illogical if the General Data Protection 
Regulation offered an automatic option to charge a reasonable fee for considering 
a request for further copies of the personal data if this is not about obtaining 
copies of documents containing personal data of data subjects, for the preparation 
of which the controller must, inter alia, allocate certain resources. It is only by 
issuing copies of personal documents that the controller incurs higher 
administrative costs for issuing them, and for this purpose it may use the option 
provided for in the General Data Protection Regulation to charge a reasonable fee 
for issuing subsequent copies. If the author of the General Data Protection 
Regulation had taken the view that it referred to information/confirmation 
regarding the processing of personal data, there would be no need to point out 
explicitly that data subjects have a clear right to obtain a copy of their processed 
personal data; it would be sufficient to retain the statement from Article 15(1) of 
the General Data Protection Regulation regarding obtaining confirmation 
concerning the processing of personal data. 
ADDIKO BANK 
 
9 
19 The Agency is of the opinion that the interpretation presented is also supported by 
recital 63 of the General Data Protection Regulation, which further explains that a 
data subject should have the right to access his/her personal data, and to exercise 
this right easily and at reasonable intervals, in order to be aware of, and verify, the 
lawfulness of the processing. This particular recital further clarifies the manner in 
which the right of access to personal data, as defined in Article 15(3), is to be 
exercised: ‘This includes the right for data subjects to have access to data 
concerning their health, for example the data in their medical records containing 
information such as diagnoses, examination results, assessments by treating 
physicians and any treatment or interventions provided.’ Therefore, from the 
clarification provided in this recital, it is clear that the right of access entails the 
right to access documentation or copies of documentation. Otherwise, the question 
would arise as to the purpose of making available data concerning assessments 
made by treating physicians if the data subject is not granted access to the 
documentation (examination results, diagnoses, assessments by treating 
physicians, and so forth). Therefore, this interpretation of the quoted recital and of 
Article 15 of the General Data Protection Regulation also applies to the present 
case, as the described method of accessing documentation implies the availability 
of data in accordance with Article 15(3) of that regulation, and specifically, in the 
form of copies of specific documents, such as loan agreements, repayment 
schedules, accounting records, and so forth. Otherwise, the question would arise 
as to the sense of merely providing information about the processing of such data 
in such situations. 
20 The Agency is of the opinion that it is clear that a copy is not the same as 
confirmation/information about personal data, and the matter at hand relates to a 
copy of documentation containing personal data being processed, namely that it is 
a completely new right that, in accordance with the principle of transparency, the 
General Data Protection Regulation offers to data subjects to ensure that the 
exercise of the rights of those subjects is enforced at an even higher level than was 
regulated in the previously applicable directive. 
21 The Agency submits that, in accordance with the General Data Protection 
Regulation, a request for the exercise of a right in connection with the processing 
of personal data does not have to be submitted on a standard form or in a manner 
specified by the controller, as the General Data Protection Regulation does not 
define clearly the appearance and content of the request for access to personal 
data. That is why a data subject may submit a request for access to personal data 
verbally or in writing. Such a request may be submitted to any department of the 
organisation (this can, therefore, include communication via social media), and 
does not need to be addressed to a specific person or contact centre. An 
application also does not have to contain the phrase “request for access to personal 
data’ or make mention of Article 15 of the General Data Protection Regulation, 
provided that it shows clearly that the data subject is requesting access to his or 
her personal data. The Agency’s position is that it is good practice to have a policy 
for recording detailed data regarding requests received, particularly requests 
submitted by telephone or in person. Perhaps in individual cases the controller 
REQUEST FOR A PRELIMINARY RULING OF 2. 5. 2023 – CASE C-312/23 
 
10  
would want to check with the data subject who submitted the request for the right 
to access his or her personal data whether that person understood the answer, and 
such actions may help to avoid later disputes as to how the controller interpreted 
the request. Therefore, the controller is responsible for ensuring that every time a 
data subject’s request itself (irrespective of whether it was submitted in writing or 
verbally) results in a possible request for the exercise of any right related to 
personal data protection, and in particular the right by which the data subject 
wishes to gain access to his or her personal data, attention is paid to adequately 
assisting the data subject in exercising this right, taking into account the 
possibility that the customer may be uneducated. Therefore, the controller is 
responsible for determining, on the basis of the data subject’s request alone, 
within the deadline, whether it is a matter of exercising a right related to personal 
data protection, also in the case when the data subject did not directly refer to, for 
example, Article 15 of the General Data Protection Regulation or the right to 
access personal data, in particular in the event that he or she explicitly mentions 
such exercise of the right. 
Arguments of the Bank 
22 The Bank is of the opinion that Article 15(3) of the General Data Protection 
Regulation does not specify any right to have documents provided, namely that 
exercising the right to access data is not the same as the right to provision of 
documentation. The source text mentions ‘a copy of the personal data’, where ‘a 
copy’ does not mean a copy of a document, but the obligation to provide a copy of 
information about personal data and the processing of personal data. The General 
Data Protection Regulation does not impose an obligation on the controller to 
issue documentation, documents and/or copies of documentation or documents at 
the request of a data subject. A document does not constitute personal data, but a 
‘medium’ on which personal data are located, and the provision in question states 
clearly that a copy of the processed personal data should be provided, and not a 
copy of the document on which the personal data are located. Pursuant to 
Article 4(1) of the General Data Protection Regulation, it is clear that a document 
is not the same as personal data. 
23 The Bank submits that recital 63 sets out a framework for the conduct of the 
personal data controller with regard to the data subject’s right to access personal 
data, and, in this sense, it in no way and nowhere defines a single document as 
personal data, nor does it require the personal data controller to provide individual 
documents to the data subject. In particular, recital 63 states that the right of 
access includes the right of the data subject to access his or her health-related data, 
for example, medical records. The emphasis is on the data in the documentation, 
not on the documentation as such. If the purpose and meaning of the right of 
access to personal data were to provide the data subject with specific 
documentation, this would certainly have been clearly and unambiguously 
indicated and defined in recital 63. 
ADDIKO BANK 
 
11 
24 The Bank takes the view that the Agency did not apply the interpretation of the 
Court of Justice in its judgment of 17 July 2014, YS and Others (C-141/12 and 
C-372/12, EU:C:2014:2081) and its position presented in the judgment of 
20 December 2017, Nowak (C-434/16, EU:C:2017:994), according to which the 
rights of access and rectification of personal data do not extend to the document as 
such (in that specific case, examination questions), which means that the 
document as such does not constitute the personal data of the data subject 
(candidate) (paragraph 58 of the judgment). 
25 The Bank is of the opinion that the purpose of the requests of borrowers of repaid 
loans was not to exercise the right of access to personal data in accordance with 
Article 15 of the General Data Protection Regulation. The right of access to data 
and the purpose of exercising the right of access to data are included in recital 63 
of the General Data Protection Regulation. This recital shows clearly that the 
purpose of exercising the [right] of access to personal data is: the right to access 
personal data so that the data subject is aware of the processing of personal data 
and can verify the lawfulness of the processing, whereby this right should not 
adversely affect the rights or freedoms of others. The same recital also states that 
the abovementioned right is expressed in the right of every data subject to know 
and obtain communication in particular with regard to the purposes for which the 
personal data are processed, where possible the period for which the personal data 
are processed, the recipients of the personal data, and the automatic processing of 
personal data. Exercising the right of access to personal data does not, therefore, 
mean the right of the data subject, according to his or her own choice, to request 
which documents the controller is required to provide, but gives him or her the 
right to obtain information about the personal data that are processed, and how 
they are processed. 
26 The Bank submits that the purpose for which the borrower requested the 
documentation was usually mentioned in the requests, directly, and that this shows 
that it is not about exercising a right in relation to personal data protection, but 
about exercising a right under a contractual or other relationship. If the purpose of 
the borrower in applying for documentation was to bring a lawsuit against the 
Bank, this does not correspond to the purposes that, in accordance with the 
General Data Protection Regulation, are provided for as the purpose of exercising 
the right to access data, namely that the data subject should determine whether his 
or her data are processed and to verify the lawfulness of the personal data 
processing. The Bank is of the opinion that the position of the Agency, according 
to which access to data does not have to be justified by stating the purpose for 
which it is requested, is contrary to the General Data Protection Regulation and 
recital 63, which regulates the purpose of exercising the right to access personal 
data. The Bank considers the Agency’s position to be incorrect, and does not 
understand why a borrower’s application that does not request the right to access 
personal data but requests documentation for the purpose of filing a lawsuit should 
be interpreted as an application for access to personal data. The Bank would like 
to ask: how can a request for the provision of selected documents result in a 
demand to exercise the right to access personal data? The borrower did not request 
REQUEST FOR A PRELIMINARY RULING OF 2. 5. 2023 – CASE C-312/23 
 
12  
information about whether and in what manner his or her personal data are being 
processed. Instead, he or she explicitly specified the documentation for which he 
or she was applying (and that he or she was already familiar with, as it has been 
fully provided to him or her). From this, it can be inferred that the borrower is 
aware of the processing of his or her data and is familiar with the processing 
methods. Therefore, the Bank is of the opinion that, from this perspective, such a 
request cannot be treated as a request for exercising the right of access to personal 
data. 
27 The Bank is of the opinion that Article 12(5) of the General Data Protection 
Regulation expressly allows and authorises the controller to consider each 
individual request that the data subject submits, namely whether it is justified and, 
therefore, whether it has been submitted in order to exercise the right in 
accordance with the purpose of the General Data Protection Regulation. The Bank 
is of the opinion that there has, in this case, been an abuse of the right under the 
General Data Protection Regulation, and it cites the judgment of the Court of 
Justice of 26 February 2019, N Luxembourg 1 and Others (C-115/16, C-118/16, 
C-119/16 and C-299/16, EU:C:2019:134), namely the view of the Court that the 
general principle of EU law that EU law cannot be relied on for fraudulent ends 
must be construed as meaning that a Member State should refuse the possibility of 
using provisions of EU law when an entity invokes them not in order to achieve 
the purpose for which those provisions are intended, but to obtain an advantage 
resulting from EU rules, despite formally respecting the conditions. 
The grounds for the request for a preliminary ruling  
28 The judgment of the Court of Justice of 17 July 2014 in Joined Cases C-141/12 
and C-372/12 cited by the Bank concerns the interpretation of Directive 95/46/EC 
of the European Parliament and of the Council of 24 October 1995 on the 
protection of individuals with regard to the processing of personal data and on the 
free movement of such data (OJ 1995 L 281, p. 31). This judgment expresses the 
view that a data subject whose data are being processed cannot have the right to 
obtain a copy of the source document or files in which those data appear 
(paragraph 58). The question arises as to whether such a view still holds good 
after the entry into force of the General Data Protection Regulation, which 
provides for the right to obtain copies of personal data. Did the General Data 
Protection Regulation significantly change the right to access data compared with 
Directive 95/46/EC? Does the concept of a copy from Article 15(3) of the General 
Data Protection Regulation involve the right of a data subject to obtain a copy of 
the source document or files that contain the personal data of the data subject? If 
the Bank retains, in a database, scanned credit-related documentation, does the 
customer have the right to obtain a copy of this scanned credit-related 
documentation from the Bank? 
29 According to one interpretation, the right to obtain a copy of personal data does 
not mean the right to obtain a copy of the source document or files in which these 
ADDIKO BANK 
 
13 
data appear. The right of access applies to data, not to documents in which these 
data appear. A literal interpretation of Article 15(3) of the General Data Protection 
Regulation may lead to the conclusion that the matter at hand concerns a copy of 
the processed data, and not a copy of the document in which the data appear. A 
teleological interpretation of the right of access may lead to the conclusion that the 
ratio legis of the right of access constitutes a preparation for the exercise of other 
rights in such a way that the access will enable the data subject to determine 
whether his or her data are being processed and to determine whether the 
processing is lawful. If this purpose can be achieved without obtaining a copy of 
the source document or files containing the personal data of the data subject, this 
individual does not have the right to a copy of the source document or files. 
30 According to a different interpretation, a data subject has the right to obtain copies 
of data in the form of copies of the source document or files in which these data 
appear. The obligation to provide a copy of the source document or files in which 
these data appear strengthens the possibility of verifying the lawfulness of the 
processing of those personal data. 
31 In the present case, it is necessary to assess whether the Bank’s customers have 
the right to obtain their personal data in the form of a copy of the credit-related 
documentation. If the answer to this question is negative, the request that is the 
subject of the complaint must be accepted, since the Bank will have been punished 
for refusing to provide its customers with credit-related documentation. 
Otherwise, if the answer is affirmative, the request that is the subject of the 
complaint should not be accepted for this reason. 
32 The question arises as to whether the reason for submitting a request for the issue 
of a copy of personal data is relevant to the assessment of the controller’s 
obligation to consider such a request. 
33 According to one interpretation, a data subject has the right to obtain a copy of 
personal data only in order to be aware of data processing and to be able to verify 
the lawfulness of the processing. If the purpose of the request is not the protection 
of personal data, but is a means of obtaining documentation that may help the data 
subject to bring a lawsuit against the controller arising from their contractual 
relationship, the controller may refuse to accept such a request. 
34 According to another interpretation, the purpose for which copies of personal data 
are requested is irrelevant to the assessment of the controller’s obligation to 
consider the request of the data subject. The data subject’s reasons for making a 
request do not determine the granting or refusing of the request. The General Data 
Protection Regulation does not specify an obligation for the data subject to 
provide the reasons for which he or she is requesting access to the data or a right 
for the controller to demand that the data subject provide such reasons. The right 
of the data subject to obtain a copy of personal data is a right that is not limited by 
purpose. 
REQUEST FOR A PRELIMINARY RULING OF 2. 5. 2023 – CASE C-312/23 
 
14  
35 In the present case, if the Bank is entitled to refuse a request for a copy of personal 
data requested by customers, not in order to be aware of the processing or to be 
able to verify the lawfulness of the processing within the meaning of recital 63 of 
the General Data Protection Regulation, but in order to obtain documentation that 
may help the customer in bringing a lawsuit against the Bank under their 
contractual relationship, the request that is the subject of the application should be 
accepted, because the Bank will have been punished for refusing to provide 
customers with credit-related documentation that facilitates them in bringing a 
civil action against the Bank. Otherwise, if the answer to the question is that the 
reason why a request for the issue of a copy of personal data was submitted is 
irrelevant for the assessment of the controller’s obligation to consider that request, 
the court will not recognise the validity of the request that is the subject of the 
complaint, for this reason. 
Questions referred for a preliminary ruling  
36 In the light of the foregoing, the following questions for a preliminary ruling are 
raised: 
(1) Is the controller obliged, in accordance with Article 15(3) of the General 
Data Protection Regulation, to provide the data subject with a copy of the 
document containing his or her personal data? 
(2) Is the controller entitled to refuse a request for a copy of personal data under 
Article 15(3) of the General Data Protection Regulation if the data subject 
requests personal data not in order to be made aware of the processing and to be 
able to verify the lawfulness of that processing within the meaning of recital 63 of 
the General Data Protection Regulation, but in order to obtain documentation that 
may assist the data subject in bringing a lawsuit against the controller, or is the 
purpose for which the data are requested not relevant to the decision to be taken 
by the controller with regard to the relevant request? 
Zagreb, 2 May 2023 
[…] [electronic signature]