Subject Access Requests – the CJEU rules on the meaning of a “copy”

The right of subject access was not invented by the GDPR, but the right seems to have acquired a higher profile under the GDPR, judging by the number of requests for clarification of the scope of the right.

One of the latest CJEU decisions is on the precise scope of the right to “a copy of the personal data undergoing processing”.  A data subject had asked for “a copy of the documents, namely emails and data base extracts containing, inter alia, his data”, and the controller sent him “in summary form, the list of his personal data undergoing processing”.  The data subject complained that he should have been sent a copy of all the documents containing his data, such as emails and database extracts.  The Court was asked whether the data subject was entitled only to an exact reproduction of the relevant personal data, or whether it might also be necessary to make text passages or entire documents available to the data subject.

The Court held that the data subject must be given “a faithful and intelligible reproduction” of all the personal data undergoing processing.  It may be necessary to provide extracts from databases or documents, or even entire documents, if that is necessary to ensure that the information provided is easy to understand, and that the data subject is able to exercise his rights to ensure that the personal data relating to him or her are correct and that they are processed in a lawful manner, but there is no absolute right to see entire documents just because those documents contain some personal data. 

This confirmation is helpful.  However most controllers are unlikely to have to change their existing procedures for handling DSARs as the decision is consistent with previous decisions by the Court under the Data Protection Directive (YS. and M. and S. v. Minister of Immigration, Integration and Asylum (C-141/12 and C372/12)) which held that data subjects did not have a right to obtain a copy of the document or original file in which their personal data appeared if the personal data could be communicated to them in another intelligible form.

This latest decision is of course not binding in the UK, but it is consistent with the UK approach.  The ICO’s guidance explains that the right of access is not a right to see copies of documents containing personal data, only the personal data itself.  It considers that information may be provided “in the form of transcripts of relevant documents (or of section of documents that contain the personal data), or by providing a print-out of the relevant information from your computer systems”.