EU Judgment in Case C-487/21 Österreichische Datenschutzbehörde and CRIF

Thursday 4th May 2023

Judgment in Case C-487/21 Österreichische Datenschutzbehörde and CRIF

(Approximation of Laws)

CRIF is a business intelligence agency which provides, at the request of its clients, information concerning the creditworthiness of third parties. For that purpose, it processed the personal data of the applicant in the main proceedings, an individual. The latter requested CRIF, on the basis of the General Data Protection Regulation, to have access to his personal data. In addition, he asked to be provided with a copy of the documents, namely e-mails and database extracts, containing, inter alia, his data, ‘in a standard technical format’.

In response to that request, CRIF sent the applicant in the main proceedings a list of his personal data being processed, in summary form. Taking the view that CRIF should have sent him a copy of all the documents containing his data, such as e-mails and database extracts, the applicant in the main proceedings lodged a complaint with the Österreichische Datenschutzbehörde (Austrian data protection authority).

That authority rejected the complaint, considering that CRIF had not committed any breach of the right of access to the personal data of the applicant in the main proceedings.

The Bundesverwaltungsgericht (Federal Administrative Court, Austria), before which the applicant in the main proceedings appealed against the rejection decision adopted by that authority, questioned the scope of the obligation laid down in the first sentence of Article 15(3) of the RGPD to provide the data subject with a ‘copy’ of his or her personal data undergoing processing.

In particular, the court wonders whether that obligation is satisfied when the controller transmits the personal data in the form of a summary table or whether that obligation also entails transmitting extracts of the documents or even entire documents, as well as extracts from databases, in which those data are reproduced.

The referring court also requests clarification of the precise meaning of the term ‘information’ in the third sentence of Article 15(3) of the RGPD.

Background Documents C-487/21