Referral C-676/25 (Viva credit, 22 Oct 2025)

Question 1
Are Article 8 of the Charter of Fundamental Rights of the European Union, Article 12(1) and (5) and Article 15(3) of Regulation (EU) 2016/679 (GDPR), read in conjunction with recitals 58 and 60 to 63 of that regulation and with the judgments of the Court of Justice in Cases C‑478/21 and C‑307/22, to be interpreted as meaning that, in the context of a terminated legal relationship between a lender and a borrower under a loan agreement, the data subject’s right to obtain a copy of personal data undergoing processing in the form of storage (archiving) for the purposes and duration of the application of anti‑money‑laundering measures also imposes on the controller an obligation, upon each request, to provide a full copy of the loan agreement in relation to which consent to the processing of the data was given?
Question 2
Is the right to data portability under Article 20(1) of the GDPR to be interpreted as also including the right of the data subject to receive a full paper copy of the loan agreements upon the conclusion of which he or she provided personal data, in a situation where:

the agreements have been terminated, and
the data collected or processed on the basis of those agreements are stored by the controller exclusively for the purposes and duration of the application of anti‑money‑laundering measures?

Question 3
What is the relationship between, on the one hand:

the principles of transparency, data minimisation and accuracy laid down in Article 5(1)(a), (c) and (d) of the GDPR; and
the rights under Article 15(1) and (3) and Article 20(1) of the GDPR, namely the rights of access to and portability of personal data undergoing processing in the form of storage (archiving) for the purposes and duration of the application of anti‑money‑laundering measures,

and, on the other hand, the controller’s obligation to provide the data subject not only with a copy of the data but also with a full copy of the loan agreement, where:

the loan agreement was concluded after the data subject had been profiled using machine‑learning algorithms; and
the controller proves that the data subject already possesses the loan agreement?

Question 4
If the obligation to provide a full copy of the loan agreement is not absolute (that is, not presumed), the personal data are processed only in the form of storage (archiving) for the purposes and duration of the application of anti‑money‑laundering measures, and the data subject claims that, without a full copy of the agreement, he or she cannot understand the context and effects of the processing, by reference to:

what objective criteria, and
under what conditions,

should the national court assess whether the controller is obliged to provide a full copy of the loan agreement?
Question 5
Within the framework of protection under Article 79 of the GDPR and Article 8 of the Charter, is an assessment by the controller that:

the loan agreement contains clauses which do not fall within the scope of the right under Article 15(1) and (3) GDPR, and
the request is disproportionate and repetitive,

subject to judicial review, and, if so, by reference to what objective criteria and under what conditions should that review be carried out by the national court?