Access to European Union law
<a href="https://eur-lex.europa.eu/content/help/eurlex-content/experimental-features.html" target="_blank">More about the experimental features corner</a>
Choose the experimental features you want to try
EUR-Lex
Access to European Union law

This document is an excerpt from the EUR-Lex website

You are here
Use quotation marks to search for an "exact phrase". Append an asterisk (*) to a search term to find variations of it (transp*, 32019R*). Use a question mark (?) instead of a single character in your search term to find variations of it (ca?e finds case, cane, care).
Search tips
Need more search options? Use the Advanced search

Document 62021CN0579

    Case C-579/21: Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus (Finland) lodged on 22 September 2021 — J.M.

    OJ C 481, 29.11.2021, p. 19–20 (BG, ES, CS, DA, DE, ET, EL, EN, FR, HR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)

    29.11.2021   

    EN

    Official Journal of the European Union

    C 481/19

    Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus (Finland) lodged on 22 September 2021 — J.M.

    (Case C-579/21)

    (2021/C 481/26)

    Language of the case: Finnish

    Referring court

    Itä-Suomen hallinto-oikeus

    Parties to the main proceedings

    Applicant: J.M.

    Other parties: Assistant Data Protection Supervisor, Pankki S

    Questions referred

    1.

    Is the data subject’s right of access under Article 15(1) of the General Data Protection Regulation, (1) considered in conjunction with the [concept of] ‘personal data’ within the meaning of point 1 of Article 4 of that regulation, to be interpreted as meaning that information collected by the controller which indicates who processed the data subject’s personal data and when and for what purpose they were processed does not constitute information in respect of which the data subject has a right of access, in particular because it consists of data concerning the controller’s employees?

    2.

    If Question 1 is answered in the affirmative and the data subject does not have a right of access to the information referred to in that question on the basis of Article 15(1) of the General Data Protection Regulation because it does not constitute ‘personal data’ of the data subject within the meaning of point 1 of Article 4 of the General Data Protection Regulation, it remains necessary in the present case to consider the information in respect of which the data subject does have a right of access in accordance with Article 15(1)[(a) to (h)]:

    a.

    How is the purpose of processing within the meaning of Article 15(1)(a) to be interpreted in relation to the scope of the data subject’s right of access, that is to say, can the purpose of the processing give rise to a right of access to the user log data collected by the controller, such as information concerning personal data of the processors and the time and the purpose of the processing of the personal data?

    b.

    In that context, can the persons who processed J.M.’s customer data be regarded, under certain criteria, as recipients of the personal data within the meaning of Article 15(1)(c) of the General Data Protection Regulation, in respect of whom the data subject would be entitled to obtain information?

    3.

    Is the fact that the bank at issue performs a regulated activity or that J.M. was both an employee and a customer of the bank at the same time relevant to the present case?

    4.

    Is the fact that J.M.’s data were processed before the entry into force of the General Data Protection Regulation relevant to the examination of the questions set out above?

    (1)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).

    Top