Court case 13R70/25x – Court Ruling (Austria, 2025)

A data subject brought proceedings against a controller after it refused to provide, free of charge, digital copies of invoices and transaction data following an access request. The data subject argued that Article 15(3) GDPR entitled them to receive a complete copy of the personal data processed by the controller, including the copies of invoices and transaction data. The controller argued that it had complied with both of the data subject's requests for information in a timely and complete manner. It argued that Article 15(3) GDPR entitled the data subject to a copy of their personal data, rather than to copies of documents as such. The controller alleged that it had disclosed the payment details provided by the data subject, thereby enabling them to clearly identify which bank account had been debited. The first-instance court dismissed the data subject’s action. It acknowledged that, according to the CJEU in judgement [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0487 C-487/21], copies of whole documents must be provided only where they are indispensable for the data subject to understand the processing of their personal data or to effectively exercise their GDPR rights. The court considered that the data subject had not proved such necessity. It noted that they had already received the relevant invoices during the contractual relationship following the respective billing periods and the information disclosed by the controller was sufficient to understand the processing at issue. The therefore found that the controller could make any re-sending of invoices conditional upon payment of a fee. The data subject appealed to the Higher Regional Court of Vienna (OLG WIEN) and argued that in accordance with the case law of the CJEU ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62022CJ0307 CJEU judgment C-307/22]) a data subject need not provide reasons for requesting a copy of their personal data from the controller, and that the right to obtain a copy of personal data applies even where the request serves purposes unrelated to GDPR. They further argued that the first-instance court had incorrectly imposed on them the burden of proving that the copies were necessary for the exercise of their GDPR rights. The court acknowledged that according to C-307/22, an access request does not need to be justified and is not manifestly unfounded or abusive merely because the data subject pursues objectives unrelated to data protection. It nevertheless stated that motives unrelated to data protection may become relevant when it comes to the scope of the right to access data. The court referred to C-487/21 and held that the right to a copy under Article 15(3) GDPR means that the data subject must be provided with a faithful and intelligible reproduction of the personal data where this is indispensable for understanding the processing at issue and enabling the data subject to effectively exercise their GDPR rights. The court considered that the data subject bears the burden of proving why copies of the requested documents are indispensable. It emphasized that a general assertion that the documents are needed to ensure the completeness of the response is insufficient. It further stated that this requirement also applies where the request pursues objectives unrelated to data protection. The court upheld the legal assessment of the first-instance court and dismissed the appeal.