What is a copy? – The Advocate General explains the interpretation of Art. 15 (3) GDPR

For a long time now, European privacy advocates have been disputing the scope of a copy in connection with the right to information. There are several points of contention here, including the question of what is meant by the copy of personal data that sometimes has to be provided in connection with a right to access. A dispute that only appears to be legal hair-splitting at first glance, but actually has a significant impact on the scope of rights to information and is, therefore, decisive for the effort required by controllers to redress such claims. The Advocate General of the European Court of Justice, Giovanni Pitruzzella, recently took a clear position on this issue to a great extent with an Opinion in Case C-487/21 that is well worth reading.  

Background

According to Art. 15 (1) sentence 1 GDPR, the data subject has the right to request confirmation from the controller as to whether personal data relating to them is being processed. If this is the case, they may request information regarding various circumstances in connection with the processing – in particular about the processed personal data. In this context, the controller has to provide a copy of the personal data that is the subject of the processing pursuant to Art. 15 (3) sentence 1 GDPR. And this was exactly the subject of the various questions the Advocate General had to deal with. The scope of the ‘copy’, inter alia, within the meaning of Art. 15 (3) sentence 1 GDPR is in dispute. The underlying question is whether a copy of the entire document containing the personal data or only the personal data processed therein is to be provided. The question of the legal nature of Art. 15 (3) GDPR also arises with regard to redressing requests for information. Is this an independent claim that exists alongside the actual right to access?

Copies of personal data that are the subject of processing must be issued

In the Opinion, the Advocate General initially concludes that a copy of the personal data that is the subject of the processing must be issued. Admittedly, as the Advocate General notes, the term ‘copy’ – contrary to the concepts of personal data and processing – is not defined in the GDPR. However, it follows from the wording of Art. 15 (3) GDPR that a copy must contain a verbatim reproduction of the personal data, which enables the data subject to ‘have full knowledge of all the data undergoing processing’ (recital 44 of the Opinion). The format of the copy depends on the data being processed and can take various forms, e.g. paper sizes or audio or video recordings. However, it is important ‘that the copy of such data is faithful and allows the data subject to have full knowledge of all the data undergoing processing’ (recital 44 of the Opinion). According to the Advocate General, the concept of personal data is to be interpreted very broadly with reference to the case law of the European Court of Justice (’ECJ’). The copy includes not only the personal data collected, processed and stored by the controller, ‘but also […] any further data that might have been generated by that controller as a result of the processing if such data also undergo processing’ (recital 37 of the Opinion).

Copy usually limited to the personal data

The Advocate General quite clearly seems to assume that copies of entire documents, for example, are not to be automatically handed out, but rather only the personal data contained therein. There is neither a ‘general right to obtain a partial or full copy of the document that contains his or her personal data’, nor to extract such from a database if the personal data is processed therein (recital 70 of the Opinion).

Nevertheless, the Advocate General does not completely exclude the disclosure of entire documents by stating that, according to Art. 15 (3) GDPR, it is also not completely ruled out that copies of the (entire) document are nevertheless to be released in individual cases if it ‘were necessary to ensure that the personal data undergoing processing and in respect of which access is requested are fully intelligible’ (recital 70 of the Opinion). The Advocate General did not explain when this is the case. From the point of view of the controller, careful action and precise examination of the circumstances will be required if the ECJ should follow this Opinion (see below). This is because the controllers are responsible for the completeness of information claims and must guarantee them. 

This ‘exception’ could, with a correspondingly broad interpretation, be used to demand the surrender of entire documents, although this is not actually what the Advocate General intended. 

Following on from this, but not decisively pursued by the Advocate General, the question also arises as to when a document as a whole becomes personal data. The German Federal Administrative Court recently accepted this for exams in the second state law examination (cf. Press Release No. 76/2022 (in German)). However, this jurisprudence cannot easily be applied to other cases.

Legal nature of Art. 15 (3) GDPR – no independent right

Furthermore, the Advocate General elaborates that, in his view, Art. 15 (3) GDPR is not an independent right. Rather, Art. 15 (3) GDPR is included in the right of access under Art. 15 (1) GDPR. Art. 15 (3) GDPR regulates the modalities of exercising a right to access and determines, inter alia, the form ‘in which the controller must provide the data subject with personal data, that is to say, in the form of a copy and, therefore, a faithful reproduction of the data’ (recital 49 of the Opinion). Accordingly, Art. 15 (3) GDPR is a specification of the right to access.

Outlook

What sounds like a high-ranking legal battle of opinion is in fact a fundamental issue with a major impact on companies of all types and sizes. The core question of whether ‘a copy is a copy’ or whether it only includes the personal data contained in a document has a major influence on redressing access rights. Experience has shown that those looking for information are usually customers or (former) employees. According to the broad view, copies of all documents are to be provided. In the case of long-term employment or business relationships, this can affect thousands of documents, with some of which often already archived and are therefore difficult to obtain. In such cases, the effort is extraordinarily high, as are the costs for the companies concerned. 

Even according to the narrower view, the information must always be complete, which can lead to considerable effort in the aforementioned case, but the cost burden in particular should be significantly lower. 
From a corporate perspective, it is once again important to follow legal developments closely. Even if the ECJ sometimes follows the Advocate General’s Opinion, this is not always the case. Only the decision of the ECJ will finally provide clarity here. Until then, affected companies should therefore carefully consider how they can ensure that they adequately redress claims for access.
 
We will keep you informed.