Addiko Bank – CJEU Judgment (Croatia, 2024)

Between May 2018 and April 2019, several customers of a bank (‘controller’) asked it to provide them with a copy of documents containing their personal data, including loan contracts they had concluded, repayment plans, documents relating to changes in interest rates and account statements. Some of these requests were explicitly motivated by the data subjects’ desire to bring a claim or legal action against the controller. The controller refused to give access to these documents. The data subjects lodged complaints with the Croatian DPA claiming that this rejection constituted a violation of Article 15(3) GDPR. As the controller did not comply with the injunctions issued by the DPA in 26 specific cases, the DPA ordered it to pay a HRK 1,100,000 (€146,667) fine. The controller considered that Article 15(3) GDPR confers only a right to a copy of the personal data being processed, to the exclusion of the documents containing them. Therefore, the controller brought an action before the Administrative Court of Zagreb against the administrative fine imposed by the DPA. The Administrative Court decided to stay the proceedings and referred the following questions to the CJEU: 1) Does Article 15(3) GDPR oblige the controller to provide the data subject with a copy of the document containing their personal data? 2) May the controller reject an access request made as a means of obtaining documentation to assist the data subject with bringing legal proceedings against the controller? On the first question First, the CJEU indicated that by its wording, Article 15(3) GDPR confers on the data subject the right to obtain an accurate reproduction of personal data concerning them, understood in a broad sense, which are subject of a processing carried out by the controller (§25 of the Order). Second, the CJEU noted that the term ‘copy’ does not refer to a document as such, but to the personal data it contains, which must be complete. The copy must therefore contain all the pe