Judgment;Abstract — ECLI:EU:C:2023:369
Date: 2023-05-04
Language of the case: German
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Austria

Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
9 August 2021 
Referring court: 
Bundesverwaltungsgericht (Austria) 
Date of the decision to refer: 
9 August 2021 
Applicant: 
F.F. 
Defendant authority: 
Österreichische Datenschutzbehörde  
Party also involved in the proceedings: 
CRIF GmbH 
      
Subject matter of the case in the main proceedings 
Action brought against a decision of the Österreichische Datenschutzbehörde 
(Austrian Data Protection Authority) on the issue of providing a copy of processed 
personal data in connection with an information request pursuant to Article 15(3) 
of Regulation (EU) 2016/679. 
Subject matter and legal basis of the request 
Interpretation of Article 15 of Regulation (EU) 2016/679; Article 267 TFEU 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-487/21 
 
2  
Questions referred for a preliminary ruling 
1. Is the term ‘copy’ in Article 15(3) of Regulation (EU) 2016/679 of the 
European Parliament and of the Council of 27 April 2016 on the protection 
of natural persons with regard to the processing of personal data and on the 
free movement of such data, and repealing Directive 95/46/EC (General 
Data Protection Regulation, OJ L 119 of 4 May 2016, p. 1; ‘the GDPR’) to 
be interpreted as meaning a photocopy, a facsimile or an electronic copy of 
(electronic) item of data, or does it also cover an ‘Abschrift’, a ‘double’ 
(‘duplicata’) or a ‘transcript’, in line with the understanding of the term in 
German, French and English dictionaries? 
2. Is the first sentence of Article 15(3) of the GDPR, according to which ‘the 
controller shall provide a copy of the personal data undergoing processing’, 
to be interpreted as affording a general right for a data subject to obtain a 
copy of – also – entire documents in which the personal data of that data 
subject are processed, or to receive a copy of a database extract if the 
personal data are processed in such a database, or does the data subject have 
a right – only – to an exact reproduction of the personal data about which 
information is to be provided pursuant to Article 15(1) of the GDPR? 
3. In the event that Question 2 is answered to the effect that the data subject 
has a right only to an exact reproduction of the personal data about which 
information is to be provided pursuant to Article 15(1) of the GDPR, is the 
first sentence of Article 15(3) of the GDPR to be interpreted as meaning 
that, depending on the nature of the data processed (for example in relation 
to the diagnoses, examination results and assessments mentioned in 
recital 63 or documents in relation to an examination within the meaning of 
the judgment of the Court of Justice of 20 December 2017, Nowak, 
C-434/16, EU:C:2017:994) and the transparency requirement in 
Article 12(1) of the GDPR, it may nevertheless be necessary in individual 
cases to make text passages or entire documents available to the data 
subject? 
4. Is the term ‘information’ which, pursuant to the third sentence of 
Article 15(3) of the GDPR, ‘where the data subject makes the request by 
electronic means, and unless otherwise requested by the data subject, […] 
shall be provided in a commonly used electronic form’, to be interpreted as 
referring solely to the ‘personal data undergoing processing’ mentioned in 
the first sentence of Article 15(3) of the GDPR? 
a. If Question 4 is answered in the negative: Is the term ‘information’ 
which, pursuant to the third sentence of Article 15(3) of the GDPR, 
‘where the data subject makes the request by electronic means, and 
unless otherwise requested by the data subject, […] shall be provided 
in a commonly used electronic form’ to be interpreted as also referring 
to the information pursuant to Article 15(1)(a) to (h) of the GDPR? 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE AND CRIF 
 
3 
b. If Question 4a also is answered in the negative: Is the term 
‘information’ which, pursuant to the third sentence of Article 15(3) of 
the GDPR, ‘where the data subject makes the request by electronic 
means, and unless otherwise requested by the data subject, […] shall 
be provided in a commonly used electronic form’ to be interpreted as 
referring, beyond the ‘personal data undergoing processing’ and the 
information pursuant to Article 15(1)(a) to (h) of the GDPR, to 
associated metadata, for example? 
Provisions of EU law cited 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), recital 63 
and Articles 4, 12 and 15 
National case-law cited 
In favour of a restrictive interpretation: 
– Decision of the Bundesverwaltungsgericht (Federal Administrative Court, 
Austria) of 23 September 2020 (W256 2226269-1/13E) 
– Judgment of the Arbeitsgericht Bonn (Labour Court, Bonn, Germany) of 
16 July 2020 (3 Ca 2026/19) 
In favour of a broad interpretation: 
– Judgment of the Oberster Gerichtshof (Supreme Court, Austria) of 
17 December 2020 (6 Ob 138/20t) 
– Decision of the Bundesverwaltungsgericht (Federal Administrative Court, 
Austria) of 2 March 2020 (W214 2224106-1/13E) 
– Judgment of the Verwaltungsgericht Schwerin (Administrative Court, 
Schwerin, Germany) of 29 April 2021 (1 A 1343/19 SN) 
Brief summary of the facts and procedure 
1 By letter of 20 December 2018, the applicant asked a credit reference agency to 
provide, inter alia, information on personal data pursuant to Article 15 of the 
GDPR and to send a copy of his processed data in a standard technical format. 
2 The credit reference agency provided some of the information requested in an 
aggregated form, reproducing the data stored in relation to the applicant’s person 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-487/21 
 
4  
firstly in a table broken down by name, date of birth, street, postcode and city, and 
secondly in a summary relating to corporate functions and powers of 
representation. More detailed documents such as emails or printouts of databases 
were not sent to the applicant. 
3 On 16 January 2019, the applicant lodged a complaint with the Data Protection 
Authority concerning the unsatisfactory response to his request for information, 
claiming, inter alia, that he had not been provided with a copy of the data. 
4 The Data Protection Authority dismissed the complaint by decision of 
11 September 2019. 
5 The applicant brought an action against that decision before the Federal 
Administrative Court. 
6 In so far as the action concerns Article 15(3) of the GDPR, the Federal 
Administrative Court has decided to request a preliminary ruling from the Court 
of Justice of the European Union. 
Principal arguments of the parties in the main proceedings 
7 The applicant submits that the ‘copy of the data’ refers, for example, to emails 
and extracts from databases containing personal data. The right to obtain a copy of 
the data exists independently of the right to obtain information about the content 
of the data processed, since processing of the data copy is prohibited, other than in 
the cases referenced in Article 15(4). 
8 The credit reference agency states in this regard that there is, in principle, no 
need to issue a copy of the data and also that no resulting additional benefit to the 
applicant could be identified in the present case. It states that all the information 
and data are derived from the request for information and the information itself 
and that no further data have been stored. Issuing a copy would also adversely 
affect its business secrets, as a copy of data from the relational database would 
inevitably also reproduce the logical-mathematical links of the individual data 
records. 
9 The Data Protection Authority submits that the applicant is not entitled to a 
copy in the form of a facsimile. Information concerning personal data under data 
protection law serves to verify whether data were processed in accordance with 
the law and as preparation for the rectification, erasure or blocking of the data (see 
judgments of the Court of Justice of 7 May 2009, Rijkeboer, C-553/07, 
EU:C:2009:293, and of 17 July 2014, YS and Others, C-141/12 and C-372/12, 
EU:C:2014:2081). In that regard, the right to information is an accompanying 
procedural right and the applicant’s interest is therefore limited on a legislative 
level. The authority has already ruled, with reference to recital 63 of the GDPR 
and to the judgment in YS and Others, that Article 15(3) of the GDPR does not 
grant the data subject the right to obtain a copy of documents containing personal 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE AND CRIF 
 
5 
data. Article 15(3) of the GDPR merely provides for the right to obtain a ‘copy of 
the personal data undergoing processing’. This reasoning does not lead to the 
assumption that copies of documents in the form of entire facsimiles can be 
requested on the basis of Article 15(3) of the GDPR, as this cannot be inferred 
from the wording of that provision. Directive 2011/24/EU also argues against such 
disclosure of entire documents: Article 2(c) thereof refers to Directive 95/46/EC 
(now the GDPR) and does not affect it. Article 4(1)(f) and Article 5(d) of 
Directive 2011/24/EU expressly provide for a right to receive a copy of ‘medical 
records’ – that is to say, a right to obtain copies of entire documents. If, in the 
light of that provision, the content of Article 15(3) of the GDPR were deemed to 
refer to the disclosure of entire documents, the rules in other legal acts, such as 
Directive 2011/24/EU, would be irrelevant. 
Brief summary of the basis for the reference 
10 The question to be specifically assessed by the Federal Administrative Court is 
whether sending the applicant’s personal data in the form of a table and a 
summary in the credit reference agency’s information letter was sufficient to 
comply with his right to receive a copy of his personal data under Article 15(3) of 
the GDPR, or whether the applicant has a right to receive a copy of his personal 
data undergoing processing by the credit reference agency not in isolation, but in 
the form of copies or excerpts of any correspondence and database contents or 
similar. If the answer is in the affirmative, his action would have to be upheld, 
since such documents have not yet been provided and the Data Protection 
Authority has, in the contested decision, rejected his right thereto. 
11 On the basis of disputed academic opinions and the equally inconsistent case-law, 
the referring Chamber is unsure as to what is literally meant by the term ‘copy’ in 
the first sentence of Article 15(3) of the GDPR (Question 1). 
12 Is this provision intended to clarify or modify the general right of access under 
Article 15(1) of the GDPR, specifying how a data subject should obtain access to 
his or her processed personal data? Or does that provision establish a stand-alone, 
independent right, going beyond the right of access set out in Article 15(1) of the 
GDPR, to a photocopy/facsimile/database printout or an (electronic) database 
extract or to a copy of entire documents and records containing the personal data 
of the data subject? These questions form the basis of Question 2. 
13 The more restrictive approach in the legal literature and case-law is based on the 
ratio legis for the right of access being – to put it simply – to allow the data 
subject to exercise further rights and in this sense focuses more on the 
presentation of the information about the processed personal data, such as in 
aggregated form, for example as a list. In that regard, reference is made to 
recital 63 of the GDPR, according to which a data subject should have a right of 
access to personal data which have been collected concerning him or her in order 
to be aware of, and verify, the lawfulness of the processing. In addition, it is 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-487/21 
 
6  
argued that the wording of Article 15(3) of the GDPR refers to a copy of the data 
undergoing processing and not to a copy of the documents in which the data are 
used. 
14 Extensive access prioritises the broad protective purpose of the GDPR as a whole, 
which may result in increased monitoring power for the data subject: accordingly, 
the legal right to receive a copy of the data in the form of a photocopy, a 
facsimile, a database printout or an (electronic) database excerpt or a copy of 
entire documents and records would increase verifiability or, according to some, 
make it possible in the first place. Only in this way would it be possible to verify 
whether the data have been correctly assigned to the correct person, for example a 
photograph in the case of similar objects (for instance, identical terraced houses). 
In addition, reference is also made to the wording of recital 63 of the GDPR, 
which refers to direct access to personal data, not to access to a summary. 
15 To aid their interpretation, both approaches also use the provision of Article 15(4) 
of the GDPR, according to which the right to obtain a copy referred to in 
paragraph 3 must not adversely affect the rights and freedoms of others. It might 
be inferred from that provision that the data to be provided as a copy must not be 
presented in isolation, but always in the context of their processing, that is to say 
as part of an entire document (such as an email) or as an extract from a database 
showing more than the personal data. However, it could also be inferred that the 
provision refers only to cases in which the personal data undergoing processing 
that are to be provided and copied cannot be isolated because they are inextricably 
linked to protected data of third parties, such as in a film recording that also shows 
other people. 
16 In the event of a restrictive interpretation of the first sentence of Article 15(3) of 
the GDPR, to the effect that ‘copy’ does not mean a right to obtain photocopies, 
entire documents or database extracts, the question then arises, in the light of the 
types of data expressly mentioned in recital 63 and the requirement of 
transparency under Article 12(1) of the GDPR, as to whether there may 
nevertheless be an obligation in individual cases, depending on the nature of the 
personal data processed, for the data controller to provide a copy of text passages 
or of documents (Question 3). 
17 Finally, the term ‘information’ in the third sentence of Article 15(3) of the GDPR 
can also be interpreted in favour of both approaches – restrictive and extensive – 
which is why it appears necessary to ask whether this term refers solely to the 
‘personal data undergoing processing’ mentioned in the first sentence of 
Article 15(3) of the GDPR (Question 4) or whether it goes further than this and 
also covers the information pursuant to Article 15(1)(a) to (h) (Question 4a), or 
even further, and refers for example to the metadata associated with the data 
(Question 4b) – as it is sometimes argued in reference thereto that Article 15(3) of 
the GDPR first mentions personal data and then information. 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE AND CRIF 
 
7 
18 The Austrian Supreme Court has already stated, in its judgment of 17 December 
2020, 6 Ob 138/20t, that Article 15(3) and Article 12(5) of the GDPR 
fundamentally give rise to the right for a patient to access a copy of his or her 
medical history. Recital 63 expressly mentions data from medical records. The 
statement from the Supreme Court might refer ‘only’ to medical history, as a 
particularly essential and sensitive form of personal data, but it might also be 
regarded as a statement about the general right to obtain copies of processed 
personal data.