CJEU, 27 May 2024, C-312/23 (Addiko Bank)

Order of the Court (Sixth Chamber) of 27 May 2024 –
Addiko Bank

(Case C-312/23)

( Reference for a preliminary ruling – Article 99 of the Rules of Procedure of the Court of Justice – Questions the answer to which may be clearly deduced from the Court’s existing case-law – Protection of natural persons with regard to the processing of personal data and free movement of such data – Regulation (EU) 2016/679 – Article 15 – Right of access by the data subject to the personal data concerning him or her that are undergoing processing – Right to obtain a copy of those data – Concept of ‘copy’ – Reasons for the request for access to those data – Use of the data to bring legal proceedings )

1.      Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Provision of a copy of the data – Concept of copy – Giving the data subject a faithful and intelligible reproduction of those data – Copies of extracts from documents or even of entire documents or of extracts from databases containing, inter alia, those data – Included – Condition

(European Parliament and Council Regulation 2016/679, recital 58 and Arts 12(1) and 15(1) and (3); European Parliament and Council Directive 95/46, Art. 12(a))

(see paragraphs 25-29, 31-33, operative part 1)

2.      Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Right to obtain a first copy of his or her data free of charge – Obligation of the controller to provide such a copy – No obligation for the data subject to provide reasons for his or her request for access to data which stem from the preamble to the regulation

(European Parliament and Council Regulation 2016/679, recital 63, first sentence, and Arts 4(2) and (7), 15(1) and (3))

(see paragraphs 39, 40, 43, 48, 49, 51, 52, operative part 2)

Operative part

must be interpreted as meaning that the right of the data subject to obtain a copy of the personal data concerning him or her that are undergoing processing means that that person must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain a full copy of the documents that contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to verify how accurate and exhaustive those data are, as well as to ensure they are intelligible.

must be interpreted as meaning that the controller is under an obligation to provide the data subject who has made the request with a copy of his or her personal data undergoing processing, even where the reason for that request is not related to those referred to in the first sentence of recital 63 of that regulation.