Judgment;Abstract — ECLI:EU:C:2023:501
Date: 2023-06-22
Language of the case: Finnish
Court formation: First Chamber
Subject matter: Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Finland

Translation C-579/21 – 1 
Case C-579/21 
Request for a preliminary ruling 
Date lodged:  
22 September 2021 
Referring court:  
Itä-Suomen hallinto-oikeus (Finland) 
Date of the decision to refer:  
21 September 2021 
Applicant:  
J.M. 
Other parties: 
Assistant Data Protection Supervisor 
Pankki S  
  
ITÄ-SUOMEN HALLINTO-
OIKEUS (ADMINISTRATIVE 
COURT, EASTERN FINLAND) 
INTERLOCUTORY 
ORDER 
[…] 
  […] 
 […] […] 
 […] […] 
 
SUBJECT 
MATTER 
OF THE 
PROCEEDINGS 
Request to the Court of Justice of the European Union for a 
preliminary ruling pursuant to Article 267 of the Treaty on 
the Functioning of the European Union (TFEU) 
Applicant J.M. 
Other parties Assistant Data Protection Supervisor 
Pankki S 
Contested decision  
 Decision of the Assistant Data Protection Supervisor of 
4 August 2020 […] 
 
EN 
REQUEST FOR A PRELIMINARY RULING OF 21. 9. 2021 – CASE C-579/21 
 
2  
Subject matter of the main proceedings and facts relevant to the decision to 
be given 
1 The case before the Administrative Court, Eastern Finland raises the question as 
to how Article 4, point 1, and Article 15(1) of Regulation (EU) 2016/679 of the 
European Parliament and of the Council on the protection of natural persons with 
regard to the processing of personal data and on the free movement of such data, 
and repealing Directive 95/46/EC (General Data Protection Regulation) are to be 
interpreted. 
2 The main proceedings concern the interpretation of the term ‘personal data’ and 
the data subject’s right of access to data which have been collected concerning 
him or her. J.M., who brought the proceedings before the Administrative Court, 
Eastern Finland, worked as an employee at Pankki S (‘the Bank’). J.M. was also a 
customer of the Bank. According to J.M., he became aware in 2014 that his own 
customer data had been reviewed during the period from 1 November to 
31 December 2013, when he was working at the Bank. J.M. suspected that the 
reasons why his data were reviewed were not entirely lawful. By letter of 29 May 
2018, he asked the bank to provide him with information revealing the identity of 
the persons who processed his customer data during the period from 1 November 
to 31 December 2013 and to inform him of the purpose of the processing of his 
customer data. J.M. has since been dismissed by the Bank. J.M. justified his 
request for information inter alia on the ground that he wanted clarification as to 
the reasons for his dismissal. 
3 In its reply to J.M. of 30 August 2018, the Bank, in its capacity as controller, 
refused to provide information on the names of the employees who had processed 
his customer data. The Bank takes the view that a person’s right of access to his or 
her own data under Article 15 of the General Data Protection Regulation does not 
apply to the log data of the Bank’s data processing system. According to the Bank, 
the information requested is personal data of the employee who processed the 
data, not of the customer. In its reply to J.M., the Bank, in its capacity as 
controller, stated that it would provide further explanations concerning the log 
data in order to clear up any misunderstandings. According to those explanations, 
in 2014, the Bank’s internal audit department investigated the processing of J.M.’s 
customer data in the period from 1 November to 31 December 2013. The 
department concluded that four employees of the Bank had processed J.M.’s data 
during the period covered by the request and that the processing of the data was 
related to the processing of data of another customer of the Bank with whom J.M. 
had a connection when he had handled the matter. The data of the other customer 
showed that a person named J.M. was a debtor in a debt relationship with him. 
Since J.M. was at the same time responsible for that customer at the Bank as a 
customer advisor, the Bank was required to ascertain whether the debtor in 
question was J.M. and whether there might therefore have been an impermissible 
conflict of interest. According to the Bank, the investigation of the case also 
required the processing of J.M.’s data, and every member of the Bank’s staff who 
had processed his data gave a statement to the internal audit department on the 
PANKKI S 
 
3 
reasons for the processing of the data. Furthermore, the Bank stated that it does 
not suspect J.M. of any wrongdoing in connection with the data processing that 
took place at the Bank in 2013. 
4 J.M. referred the matter to the national supervisory authority, that is to say, the 
Office of the Data Protection Supervisor, and requested that the latter order the 
Bank to provide the information requested. J.M. takes the view that every person 
has a right to [have access to] matters and information concerning him or her. 
Information on the processing of customer data is not directly a person’s own 
data, but is directly related to the proper processing of a person’s data and to the 
requirement to ensure such processing. If a person did not have a right to obtain 
such information, the data subject would have no effective means of verifying 
whether the data concerning him or her had been processed properly. 
5 By decision of 4 August 2020 […], the Assistant Data Protection Supervisor 
refused J.M.’s request for access to the Bank’s information that he had requested. 
The Assistant Data Protection Supervisor therefore did not issue an order to the 
Bank, in its capacity as controller, to comply with J.M.’s request to exercise his 
rights pursuant to the regulation, within the meaning of Article 58(2)(c) of the 
General Data Protection Regulation. In his decision, the Assistant Data Protection 
Supervisor stated that J.M.’s requests in fact constituted a request for access to 
user log data. In his decision, the Assistant Data Protection Supervisor referred to 
his previous decision-making practice, in accordance with which user log data are 
not data concerning the customers themselves, but data concerning the employees 
who had processed the customer data. Therefore, the data contained in the user log 
had not been regarded as being covered by the right of access under Paragraph 26 
of the Law on personal data (523/1999), 1 which was previously in force under 
national law. Accordingly, the right to review log data outside the scope of 
specific laws has been reserved for persons who have processed the personal data 
contained in the filing system themselves. The Assistant Data Protection 
Supervisor further takes the view that, for the purposes of the General Data 
Protection Regulation, log data are to be regarded as data relating precisely to the 
employees who had processed the customer data and, therefore, the log data do 
not constitute data concerning J.M., in respect of which he has a right of access 
under Article 15 of the Regulation. 
6 By his action before the Administrative Court, Eastern Finland, J.M. requested 
that the decision of the Assistant Data Protection Supervisor be annulled. J.M. 
takes the view that he is entitled under the General Data Protection Regulation to 
obtain information concerning the identity of the persons who had reviewed his 
data at the Bank and concerning their position within the Bank. He submits that 
the information is necessary to demonstrate a personal data breach by the 
controller. The controller must be able to demonstrate that J.M.’s personal data 
had been processed lawfully, fairly and in a transparent manner. The controller’s 
 
1 Finlex: https://www.finlex.fi/fi/laki/ajantasa/kumotut/1999/19990523 
REQUEST FOR A PRELIMINARY RULING OF 21. 9. 2021 – CASE C-579/21 
 
4  
own statement regarding the processing of J.M.’s data does not meet the 
requirements of the General Data Protection Regulation. 
7 The Assistant Data Protection Supervisor reiterated his view before the 
Administrative Court that the information requested relates precisely to the 
employees who had processed the customer data and that the data subject’s right 
of access therefore does not extend to that information. 
8 In its statement on the draft request for a preliminary ruling, the Bank stated that 
the log data requested by J.M. are not his personal data, and such information 
therefore could not be covered by the right of access under the General Data 
Protection Regulation. 
Provisions of national law and case-law relied on 
Law on data protection (1050/2018) 
9 According to Paragraph 1 of the Law on data protection, that law gives specific 
effect to and complements Regulation (EU) 2016/679 of the European Parliament 
and of the Council on the protection of natural persons with regard to the 
processing of personal data and on the free movement of such data, and repealing 
Directive 95/46/EC (General Data Protection Regulation) and the implementation 
of that regulation at national level. 
10 According to Paragraph 30 of that law, the provisions on the processing of 
employees’ personal data, on the tests and checks to be carried out in respect of 
employees and the requirements to be complied with in that regard, on technical 
monitoring at the workplace and on the retrieval and opening of an employee’s 
emails are contained in the Law on the protection of privacy in working life 
(759/2004). 
11 Under Paragraph 34(1) of that law, the data subject has no right of access to data 
collected concerning him or her within the meaning of Article 15 of the General 
Data Protection Regulation where 
1) the provision of the data could adversely affect national security, defence or 
public order and security or jeopardise the prevention or investigation of criminal 
offences; 
2) the provision of the data could pose a serious risk to the health or care of the 
data subject or to the rights of the data subject or a third party; or 
3) the personal data are used in supervisory and control activities and the 
withholding of the data is necessary for the protection of an important economic 
or financial interest of Finland or the European Union. 
PANKKI S 
 
5 
12 According to subparagraph 2 of the same provision, where only part of the data 
referred to in subparagraph 1 is not covered by the right provided for in Article 15 
of the General Data Protection Regulation, the data subject shall be entitled to 
obtain access to all other data concerning him or her. 
13 According to subparagraph 3 of the same provision, the data subject must be 
informed of the reasons for the restriction, unless this would undermine the 
purpose of the restriction. 
14 According to subparagraph 4 of the same provision, where the data subject does 
not have a right of access to the data collected concerning him or her, the data 
referred to in Article 15(1) of the General Data Protection Regulation must be 
made available to the Data Protection Supervisor at the request of the data subject. 
Law on the protection of privacy in working life (759/2004) 
15 According to Section 2, Paragraph 4(2) of the Law on the protection of privacy in 
working life (347/2019), the employer is obliged to inform the employee in 
advance of the collection of data that serve to determine his or her reliability. If 
the employer checks the employee’s creditworthiness, the employer must also 
inform the employee of the register from which the credit information is to be 
obtained. Where data concerning the employee have been collected from a person 
other than the employee himself or herself, the employer must inform the 
employee of the data obtained before they are used to make decisions affecting the 
employee. The obligations of the controller to provide data to the data subject and 
the data subject’s right of access to data are governed by Chapter III of the 
General Data Protection Regulation. 
Specific legislation on the right of access to user log data 
16 In Finland, the right of access to user log data was provided for only in specific 
laws before the General Data Protection Regulation entered into force. Those 
specific laws are the Law on the electronic processing of customer data in social 
and health care (159/2007) 2 and the Law on the Demographic Information 
System and the certification services of the Digital and Demographic Information 
Agency (661/2009). 3 
Case-law of the Korkein hallinto-oikeus (Supreme Administrative Court; ‘KHO’) 
17 In Finland, the Supreme Administrative Court has given preliminary rulings on 
the activities of public authorities in connection with the application of the Law on 
public access to activities of public authorities (‘the Law on freedom of 
information’, 621/1999). For example, prior to the entry into force of the General 
Data Protection Regulation, the KHO held in its decision of 5 April 2014 
 
2 Finlex: https://finlex.fi/fi/laki/ajantasa/2007/20070159 
3 Finlex: https://www.finlex.fi/fi/laki/ajantasa/2009/20090661 
REQUEST FOR A PRELIMINARY RULING OF 21. 9. 2021 – CASE C-579/21 
 
6  
(KHO:2014:69) that confidential log data did not concern the person who had 
requested access to the log data, but the users of the data processing systems. In 
addition, however, the KHO held that the explanations provided by the police did 
not show that the provision of the log data would have jeopardised the 
performance of the police’s duties or the safety of personnel of the police service 
in such a way that the provision of the information would have been precluded by 
an extremely important public or private interest within the meaning of point 1 of 
Paragraph 11(2) of the Law on freedom of information. The person concerned, as 
a party to the proceedings, was therefore entitled to obtain that log data from the 
police authority. 
18 After the entry into force of the General Data Protection Regulation, the KHO 
held in a decision of 11 June 2020 (KHO:2020:72) that the administrative court 
should have heard the appeal against an administrative decision – namely that of 
the tax administration – not only as a case concerning public access to official 
documents, but also as a data protection case concerning the right of access of the 
data subject, applying the provisions of the General Data Protection Regulation. 
The KHO held that the decision had to be annulled and the case referred back to 
the administrative court with the stipulation that it hear the case also as a data 
protection case. The case is still pending at the time of drafting the present request 
for a preliminary ruling. 
Relevant provisions of European Union law relied on 
General Data Protection Regulation 
19 According to recital 60 of the General Data Protection Regulation, the principles 
of fair and transparent processing require that the data subject be informed of the 
existence of the processing operation and its purposes. The controller should 
provide the data subject with any further information necessary to ensure fair and 
transparent processing taking into account the specific circumstances and context 
in which the personal data are processed. 
20 According to recital 63 of the regulation (corrigendum [to the Finnish language 
version], OJ L 74, 4.3.2021), a data subject should have the right of access to 
personal data which have been collected concerning him or her, and to exercise 
that right easily and at reasonable intervals, in order to be aware of, and verify, the 
lawfulness of the processing. This includes the right for data subjects to have 
access to data concerning their health, for example the data in their medical 
records containing information such as diagnoses, examination results, 
assessments by treating physicians and any treatment or interventions provided. 
Every data subject should therefore have the right to know and obtain 
communication in particular with regard to the purposes for which the personal 
data are processed, where possible the period for which the personal data are 
processed, the recipients of the personal data, the logic involved in any automatic 
personal data processing and, at least when based on profiling, the consequences 
PANKKI S 
 
7 
of such processing. Where possible, the controller should be able to provide 
remote access to a secure system which would provide the data subject with direct 
access to his or her personal data. That right should not adversely affect the rights 
or freedoms of others, including trade secrets or intellectual property and in 
particular the copyright protecting the software. However, the result of those 
considerations should not be a refusal to provide all information to the data 
subject. Where the controller processes a large quantity of information concerning 
the data subject, the controller should be able to request that, before the 
information is delivered, the data subject specify the information or processing 
activities to which the request relates. 
21 According to point 1 of Article 4 of the regulation, ‘personal data’ means any 
information relating to an identified or identifiable natural person (‘data subject’); 
an identifiable natural person is one who can be identified, directly or indirectly, 
in particular by reference to an identifier such as a name, an identification number, 
location data, an online identifier or to one or more factors specific to the physical, 
physiological, genetic, mental, economic, cultural or social identity of that natural 
person. 
22 Article 5(1)(a) and (f) and Article 5(2) of the regulation read as follows: 
1. Personal data shall be: 
(a) processed lawfully, fairly and in a transparent manner in relation to the data 
subject (‘lawfulness, fairness and transparency’); 
… 
(f) processed in a manner that ensures appropriate security of the personal data, 
including protection against unauthorised or unlawful processing and against 
accidental loss, destruction or damage, using appropriate technical or 
organisational measures (‘integrity and confidentiality’). 
2. The controller shall be responsible for, and be able to demonstrate compliance 
with, paragraph 1 (‘accountability’). 
23 According to Article 15(1) of the regulation, the data subject shall have the right 
to obtain from the controller confirmation as to whether or not personal data 
concerning him or her are being processed, and, where that is the case, access to 
the personal data and the following information (corrigendum [to the Finnish 
language version], OJ L 74, 4.3.2021): 
(a) the purposes of the processing; 
(b) the categories of personal data concerned; 
REQUEST FOR A PRELIMINARY RULING OF 21. 9. 2021 – CASE C-579/21 
 
8  
(c) the recipients or categories of recipient to whom the personal data have been 
or will be disclosed, in particular recipients in third countries or international 
organisations. 
24 According to Article 24(1) of the regulation […], taking into account the nature, 
scope, context and purposes of processing as well as the risks of varying 
likelihood and severity for the rights and freedoms of natural persons, the 
controller shall implement appropriate technical and organisational measures to 
ensure and to be able to demonstrate that processing is performed in accordance 
with this Regulation. Those measures shall be reviewed and updated where 
necessary. 
25 Article 88 of the regulation provides the following in respect of the processing of 
personal data in the context of employment: 
1. Member States may, by law or by collective agreements, provide for more 
specific rules to ensure the protection of the rights and freedoms in respect of the 
processing of employees’ personal data in the employment context, in particular 
for the purposes of the recruitment, the performance of the contract of 
employment, including discharge of obligations laid down by law or by collective 
agreements, management, planning and organisation of work, equality and 
diversity in the workplace, health and safety at work, protection of employer’s or 
customer’s property and for the purposes of the exercise and enjoyment, on an 
individual or collective basis, of rights and benefits related to employment, and for 
the purpose of the termination of the employment relationship. 
2. Those rules shall include suitable and specific measures to safeguard the data 
subject’s human dignity, legitimate interests and fundamental rights, with 
particular regard to the transparency of processing, the transfer of personal data 
within a group of undertakings, or a group of enterprises engaged in a joint 
economic activity and monitoring systems at the work place. 
Relevant case-law of the Court of Justice 
26 The Administrative Court, Eastern Finland is not aware of any case-law of the 
Court of Justice in which the General Data Protection Regulation was interpreted 
in a similar situation. As the General Data Protection Regulation has not narrowed 
the concept of personal data, the Administrative Court has examined the case-law 
of the Court of Justice on Directive 95/[4]6/EC of the European Parliament and of 
the Council on the protection of individuals with regard to the processing of 
personal data and on the free movement of such data (Data Protection Directive). 
27 The Court of Justice interpreted the right of access under Article 12 of the Data 
Protection Directive in its judgment in Case C-553/07, College van burgemeester 
en wethouders van Rotterdam v M. E. E. Rijkeboer (EU:C:2009:293). That case 
concerned a situation in which a person had been refused access to information on 
the disclosure of his personal data to third parties during the two years preceding 
PANKKI S 
 
9 
his request for information. The Court of Justice held that, in order to assess the 
scope of the right of access which the Directive must make possible, it is 
appropriate, first, to determine what data are covered by the right of access and, 
next, to turn to the objective of Article 12(a) examined in the light of the purposes 
of the Directive (paragraph 40 of the judgment). The case ruled on by the Court of 
Justice involved two categories of data. The first concerned personal data kept by 
the local authority on a person, such as his or her name and address, which 
constituted, in the case ruled on, the basic data. The Court of Justice held that 
those data constitute ‘personal data’ within the meaning of Article 2(a) of the 
Directive, because they represent information relating to an identified or 
identifiable natural person. The second category concerned information on 
recipients or categories of recipient to whom those basic data were disclosed and 
on the content thereof and thus related to the processing of the basic data 
(paragraphs 41-43 of the judgment). 
28 According to the Court of Justice, that right to privacy means that the data subject 
may be certain that his personal data are processed in a correct and lawful manner, 
that is to say, in particular, that the basic data regarding him are accurate and that 
they are disclosed to authorised recipients. As is stated in recital 41 in the 
preamble to the directive, in order to carry out the necessary checks, the data 
subject must have a right of access to the data relating to him which are being 
processed. In that regard, Article 12(a) of the directive provides for a right of 
access to basic data and to information on the recipients or categories of recipient 
to whom the data are disclosed. According to the Court of Justice, that right of 
access is necessary to enable the data subject to exercise the rights set out in 
Article 12(b) and (c) of the Directive, that is to say, where the processing of his 
data does not comply with the provisions of the Directive, the right to have the 
controller rectify, erase or block his data (paragraph (b)), or notify third parties to 
whom the data have been disclosed of that rectification, erasure or blocking, 
unless this proves impossible or involves a disproportionate effort (paragraph (c)) 
(paragraphs 49-50 of the judgment). 
29 The Court of Justice stated that the scope of the Data Protection Directive is very 
wide and the personal data covered by the directive are varied (paragraph 59 of 
the judgment). 
30 The Court of Justice interpreted the concept of ‘personal data’ within the meaning 
of Article 2(a) of the Data Protection Directive in its judgment in Case C-434/16, 
Peter Nowak v Data Protection Commissioner (EU:C:2017:994). The case 
concerned a situation where a national supervisory authority refused to give a 
person access to the corrected script of an examination at which he was a 
candidate, on the ground that the information contained therein did not constitute 
personal data. In its judgment, the Court of Justice stated that the use of the 
expression ‘any information’ in the definition of the concept of ‘personal data’, 
within Article 2(a) of Directive 95/46, reflects the aim of the EU legislature to 
assign a wide scope to that concept, which is not restricted to information that is 
sensitive or private, but potentially encompasses all kinds of information, not only 
REQUEST FOR A PRELIMINARY RULING OF 21. 9. 2021 – CASE C-579/21 
 
10  
objective but also subjective, in the form of opinions and assessments, provided 
that it ‘relates’ to the data subject. As regards the latter condition, it is satisfied 
where the information, by reason of its content, purpose or effect, is linked to a 
particular person (paragraphs 34-35 of the judgment). 
31 The Court of Justice took the view that the finding that the comments of the 
examiner with respect to the answers submitted by the candidate at the 
examination constitute information which, by reason of its content, purpose or 
effect, is linked to that candidate is not called into question by the fact that those 
comments also constitute information relating to the examiner (paragraph 44 of 
the judgment). 
32 The Court of Justice also stated that if information relating to a candidate, 
contained in his or her answers submitted at a professional examination and in the 
comments made by the examiner with respect to those answers, were not to be 
classified as ‘personal data’, that would have the effect of entirely excluding that 
information from the obligation to comply not only with the principles and 
safeguards that must be observed in the area of personal data protection, and, in 
particular, the principles relating to the quality of such data and the criteria for 
making data processing legitimate, established in Articles 6 and 7 of Directive 
95/46, but also with the rights of access, rectification and objection of the data 
subject, provided for in Articles 12 and 14 of that directive, and with the 
supervision exercised by the supervisory authority under Article 28 of that 
directive (paragraph 49 of the judgment). 
33 In its judgment, the Court of Justice held that Article 2(a) of Directive 95/46 must 
be interpreted as meaning that, in circumstances such as those of the main 
proceedings, the written answers submitted by a candidate at a professional 
examination and any comments made by an examiner with respect to those 
answers constitute personal data, within the meaning of that provision. 
The need for a preliminary ruling 
34 The Administrative Court, Eastern Finland considers that the case concerns the 
interpretation of the concept of ‘personal data’ within the meaning of Article 4(1) 
of the General Data Protection Regulation and the data subject’s right of access to 
personal data collected by the controller concerning him or her, as provided for in 
Article 15(1). 
35 The respect for privacy protected by the General Data Protection Regulation 
requires that personal data are processed lawfully, fairly and in a transparent 
manner in relation to the data subject, in accordance with Article 5(1)(a) of the 
General Data Protection Regulation, and in a manner that ensures appropriate 
security of the personal data, including protection against unauthorised or 
unlawful processing, in accordance with point (f) of that paragraph. Furthermore, 
according to paragraph 2 of that article, the controller is to be responsible for, and 
be able to demonstrate compliance with, paragraph 1 (‘accountability’). In order 
PANKKI S 
 
11 
to fulfil its obligation of accountability, the controller must, in accordance with 
Article 24(1) of the General Data Protection Regulation, implement appropriate 
technical and organisational measures to ensure and to be able to demonstrate that 
processing is performed in accordance with the General Data Protection 
Regulation. For those reasons, controllers collect log data on the persons who 
processed the personal data of the data subjects and on [the time] of the processing 
of the personal data. 
36 Pursuant to Article 15, the data subject is to have the right to obtain from the 
controller confirmation as to whether or not personal data concerning him or her 
are being processed, and, where such personal data are being processed, access to 
the personal data and to information concerning the purposes of the processing, 
the [categories of personal data] concerned and the recipients and categories of 
recipients. However, it is unclear on the basis of that article whether the 
information collected by the controller pursuant to its obligation under 
Article 24(1) of the regulation, indicating the identity of the persons who 
processed the personal data of the data subject and the points in time at which the 
personal data was processed, is to be regarded as information in respect of which 
the data subject has a right of access pursuant to Article 15(1) or only as personal 
data of the persons who processed the personal data in respect of which the data 
subject does not have a right of access. 
37 Recital 9 of the General Data Protection Regulation states that the objectives and 
principles of the Data Protection Regulation (Directive 95/46/EC) remain sound, 
but it has not prevented fragmentation in the implementation of data protection 
across the Union, legal uncertainty or a widespread public perception that there 
are significant risks to the protection of natural persons, in particular with regard 
to online activity. Furthermore, recital 10 of the General Data Protection 
Regulation states that consistent and homogenous application of the rules for the 
protection of the fundamental rights and freedoms of natural persons with regard 
to the processing of personal data should be ensured throughout the Union. 
38 The present case raises the question as to whether J.M. has an effective possibility 
to ascertain the lawfulness of the processing of his personal data. User log data 
and the collection thereof also constitute information indicating that the personal 
data processed has been reviewed (content factor) and its use is likely to affect his 
or her privacy rights (impact factor). The data subject’s right of access is a 
fundamental element of the rights guaranteed to the data subject by the General 
Data Protection Regulation and the exercise of that right often precedes the 
exercise of other rights under the General Data Protection Regulation, such as the 
remedies provided for in Chapter VIII. Therefore, for example, the right to lodge a 
complaint with a supervisory authority granted to every data subject by Article 77 
of the General Data Protection Regulation is not a sufficient means in itself to 
guarantee all the abovementioned rights of the data subject in a uniform manner 
throughout the European Union. A preliminary ruling from the Court of Justice is 
necessary because it is not clear from the General Data Protection Regulation 
whether the data subject has a right of access only to his or her own actual 
REQUEST FOR A PRELIMINARY RULING OF 21. 9. 2021 – CASE C-579/21 
 
12  
customer data and any related records, or also to information about who processed 
his or her customer data, and when and for what purpose they were processed. In 
the present case, it is necessary to assess the position of the person who processed 
the data, in relation to the position of the data subject exercising his or her right of 
access. If the rights of data subjects to request access to different information 
collected by the controller differ from one Member State to another, they are 
treated differently on the basis of their place of residence and nationality. 
39 The national supervisory authority, that is to say, the Assistant Data Protection 
Supervisor, has also expressed his support for a request for a preliminary ruling to 
the Court of Justice of the European Union in the present case. 
Questions referred for a preliminary ruling 
40 The Administrative Court, Eastern Finland has ordered that the proceedings be 
stayed and the following questions be referred to the Court of Justice for a 
preliminary ruling pursuant to Article 267 TFEU: 
1. Is the data subject’s right of access under Article 15(1) of the General 
Data Protection Regulation, considered in conjunction with the 
[concept of] ‘personal data’ within the meaning of point 1 of Article 4 
of that regulation, to be interpreted as meaning that information 
collected by the controller which indicates who processed the data 
subject’s personal data and when and for what purpose they were 
processed does not constitute information in respect of which the data 
subject has a right of access, in particular because it consists of data 
concerning the controller’s employees? 
2. If Question 1 is answered in the affirmative and the data subject does 
not have a right of access to the information referred to in that question 
on the basis of Article 15(1) of the General Data Protection Regulation 
because it does not constitute ‘personal data’ of the data subject within 
the meaning of Article 4(1) of the General Data Protection Regulation, 
it remains necessary in the present case to consider the information in 
respect of which the data subject does have a right of access in 
accordance with Article 15(1)[(a) to (h)]: 
a. How is the purpose of processing within the meaning of 
Article 15(1)(a) to be interpreted in relation to the scope of the 
data subject’s right of access, that is to say, can the purpose of 
the processing give rise to a right of access to the user log data 
collected by the controller, such as information concerning 
personal data of the processors and the time and the purpose of 
the processing of the personal data? 
b. In that context, can the persons who processed J.M.’s customer 
data be regarded, under certain criteria, as recipients of the 
PANKKI S 
 
13 
personal data within the meaning of Article 15(1)(c) of the 
General Data Protection Regulation, in respect of whom the data 
subject would be entitled to obtain information? 
3. Is the fact that the bank at issue performs a regulated activity or that 
J.M. was both an employee and a customer of the bank at the same 
time relevant to the present case? 
4. Is the fact that J.M.’s data were processed before the entry into force of 
the General Data Protection Regulation relevant to the examination of 
the questions set out above? 
[…]