1. unknown (complainant before the Austrian Data Protection Autority) – Court Ruling (Austria, 2021)

A data subject (the complainant) sent an access request to an Austrian credit reference agency (the respondent), requesting (i.a.) a copy of their personal data undergoing processing pursuant to Article 15(3) in a commonly used electronic format. The respondent only provided a table that contained the personal data (name, date of birth, address data business functions of the data subject) in an aggregated form but refused to provide an actual copy of the data undergoing processing, such as database print-outs or email correspondence regarding the complainant. The respondent argued that Article 15(3) GDPR does not entitle a data subject to receive a copy of the data in the sense of a facsimile of the data. Furthermore, the disclosure of a copy would also violate the respondent's business secrets, since a copy of data from a relational database (such as the respondent's identity and creditworthiness database) would inevitably also reproduce the logical-mathematical links of the individual data records. The complainant argued that Article 15(3) GDPR entitles them to a copy of the data in the very form that these data are undergoing processing. A controller has no right to limit the right of access to a modified aggregation of the relevant data. The Austrian Data Protection authority (Datenschutzbehörde - DSB) followed the respondents argument and rejected the complainant's claim. It deemed the data and information provided by the respondent to be sufficient. The complainant consequently filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG stayed the procedure and requested the CJEU's preliminary ruling under Article 267 TFEU on the following questions: 1. Is the term "copy" in Article 15(3) GDPR to be interpreted as meaning a photocopy or facsimile or an electronic copy of (electronic) data, or does the term also cover a "transcript", un "double" ("duplicata") or a "transcript", as understood in German, French and English dictionaries? 2. Must the first sentence of Article 15(3) of the GDPR, according to which "the controller shall provide a copy of the personal data undergoing processing", be interpreted as implying a general legal right of a data subject to obtain a copy of - also - all documents relating to him or her or the provision of a copy of an extract from the database where the personal data are processed in such a database, or does this mean that the data subject has a legal right - only - to a faithful reproduction of the personal data to be provided with information pursuant to Article 15(1) of the GDPR? 3. In the event that the answer to question 2 is that the data subject only has a legal right to a faithful reproduction of the personal data to be provided pursuant to Article 15(1) GDPR: must Article 15(3) first sentence of the GDPR be interpreted as meaning that, due to the nature of the data processed (e.g. with regard to the diagnoses or examination results referred to in recital 63 or documents in connection with an examination within the meaning of the judgment of the CJEU of 20.12.2017, C-434/16) and the transparency requirement in Article 12(1) GDPR it may nevertheless be necessary in individual cases to also make text passages or entire documents available to the data subject? 4. Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as meaning only the "personal data undergoing processing" referred to in the first sentence of Article 15(3) GDPR? a. If the answer to question 4 is in the negative: Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as including, in addition, the information referred to in Article 15(1)(a) to (h) of the GDPR? b. If question 4.a. is also answered in the negative: Is the concept of "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the request is made electronically, "unless otherwise requested by the data subject", to be interpreted as referring to the "personal data undergoing processing", the information referred to in Article 15(1)(a) to (h) GDPR and information going beyond these information, such as for example associated metadata?