Case C‑307/22

FT

v

DW

(Request for a preliminary ruling from the Bundesgerichtshof)

Judgment of the Court (First Chamber), 26 October 2023

(Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 12, 15 and 23 – Data subject’s right of access to his or her data undergoing processing – Right to obtain a first copy of those data free of charge – Processing of a patient’s data by his or her medical practitioner – Medical records – Reasons for the request for access – Use of data for the purpose of triggering the liability of the person providing treatment – Concept of ‘copy’)

1. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Right to obtain a first copy of his or her data free of charge – Obligation of the controller to provide such a copy – Obligation for the data subject to provide reasons for his or her request for access to data which stem from the preamble to the regulation – None

   (European Parliament and Council Regulation 2016/679, recital 63 and Arts 12(5) and 15(1) and (3))

   (see paragraphs 35-38, 43, 46, 50-52, operative part 1)

2. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Option for the Member States to adopt a piece of legislation restricting the scope of certain rights and obligations provided for by the regulation – Piece of national legislation adopted before or after the entry into force of the regulation – Irrelevant

   (European Parliament and Council Regulation 2016/679, Art. 23(1))

   (see paragraphs 54-56, 69, operative part 2)

3. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Right to obtain a first copy of his or her data free of charge – Limitations – Conditions – Protection of the rights and freedoms of others – Option for a Member State to adopt a piece of national legislation intended to protect the economic interests of the controller and making the data subject bear the costs of a first copy of his or her data – None

   (European Parliament and Council Regulation 2016/679, Art. 23(1)(i))

   (see paragraphs 62, 64, 65, 67-69, operative part 2)

4. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Provision of a copy of the data – Concept of copy – Giving the data subject a faithful and intelligible reproduction of those data – Copies of extracts from documents or even of entire documents or of extracts from databases containing, inter alia, those data – Included – Condition

   (European Parliament and Council Regulation 2016/679, recital 58 and Arts 12(1) and 15(1) and (3), first sentence)

   (see paragraphs 71-75)

5. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Provision of a copy of the data – Concept of copy – Giving the data subject a faithful and intelligible reproduction of all the data in his or her medical records – Full copy of the documents included in the medical records – Included – Condition

   (European Parliament and Council Regulation 2016/679, recital 63 and Art. 15(3), first sentence)

   (see paragraphs 76-79, operative part 3)

Résumé

DW requested that FT, his dentist, provide him with a first copy of his medical records free of charge. He made that request with a view to triggering FT’s liability for errors allegedly made by her in providing him with dental care.

Relying on German law pursuant to which the patient may obtain a copy of his or her medical records on condition that he or she reimburse the person providing treatment for the costs resulting therefrom, ( 1 ) FT refused to provide DW with such a copy, following which DW brought an action. Both the court of first instance and the court hearing the appeal upheld DW’s request to be provided with a first copy of his medical records free of charge.

Hearing an appeal on a point of law (Revision) brought by FT, the Bundesgerichtshof (Federal Court of Justice, Germany) has put questions to the Court of Justice concerning the interpretation of the provisions of the GDPR which refer to the rules governing the exercise of the data subject’s right of access to his or her data, as well as the restrictions of the scope of that right. ( 2 )

By its judgment, the Court concludes, first of all, that, where the data subject so requests, the controller is obliged to provide him or her with a first copy of his or her personal data, free of charge, for purposes other than becoming aware of the processing of those data and verifying the lawfulness of that processing, which are explicitly referred to in the preamble to the GDPR. Next, it rules on the parameters of the option for the Member States to restrict, in the name of the economic interests of the controller, the right to obtain a copy of the data by requiring the data subject to pay fees incurred by that controller in that regard. Lastly, it examines the need to provide the data subject, in certain cases, with a full copy of the data in his or her medical records.

Findings of the Court

In the first place, as regards the question whether the controller is also under an obligation to provide the data subject with a first copy of his or her data free of charge with a view to pursuing purposes other than those explicitly referred to in the preamble to the GDPR, the Court recalls that the first sentence of Article 15(3) of that regulation confers on the data subject the right to obtain a faithful reproduction of his or her personal data, understood in a broad sense, that are subject to operations that can be classified as ‘processing carried out by the controller’. ( 3 ) In addition, it follows from a combined reading of the relevant provisions of the GDPR ( 4 ) that (i) the data subject has the right to obtain a first copy, free of charge, of his or her personal data undergoing processing and (ii) the controller is given the option, under certain conditions, to charge a reasonable fee taking administrative costs into account or to refuse to act on a request if it is manifestly unfounded or excessive.

However, none of those provisions makes the provision, free of charge, of a first copy of personal data conditional upon a data subject putting forward reasons to justify his or her request. Accordingly, the reasons for requests set out explicitly in the preamble to the GDPR ( 5 ) cannot restrict the scope of those provisions. Thus, the right to access data relating to health ( 6 ) cannot be restricted, either by refusing to grant access or by requiring the payment of consideration, to one of those reasons – a finding which also applies as regards the right to obtain a first copy free of charge.

In addition, the principle that the first copy of the data should be free of charge and the lack of a need to rely on a specific reason to justify the request for access necessarily contribute to facilitating the exercise, by the data subject, of the rights conferred on him or her by the GDPR. Consequently, given the importance which the regulation ascribes to the right to access personal data for achieving the objectives pursued by that regulation, the exercise of that right cannot be made subject to conditions which have not been expressly laid down by the EU legislature.

In the second place, the Court rules that a Member State is not entitled to adopt a piece of national legislation which, in order to protect the economic interests of the controller, makes the data subject bear the costs of a first copy of his or her personal data.

It is true that, under the GDPR, the right of the data subject to obtain a first copy, free of charge, of his or her personal data is not absolute and, under certain conditions, the protection of the rights and freedoms of others could justify a restriction of that right. ( 7 ) However, in the present case, in so far as the objective of the piece of national legislation is to protect the economic interests of persons providing treatment by preventing needless requests for copies, such considerations cannot be included in such rights and freedoms.

Indeed, that piece of legislation deters not only needless requests, but also requests seeking to obtain, for a legitimate reason, a first copy, free of charge, of processed personal data. Consequently, it is necessarily in breach of the principle that the first copy should be free of charge and thereby undermines the effectiveness of the data subject’s right of access to his or her data, provided for by the GDPR, as well as, as a result, the protection guaranteed therein.

Furthermore, the Court emphasises that the economic interests of controllers were taken into account under the GDPR, which defines the circumstances in which the controller may charge a fee connected with the provision of a copy of personal data.

In the third and last place, the Court considers that, in doctor-patient relationships, the right to obtain a copy of personal data means giving the data subject a faithful and intelligible reproduction of all those data. That right entails the right to obtain a full copy of the documents included in his or her medical records if this is essential in order to enable the data subject to verify how accurate and exhaustive his or her data are, as well as to ensure they are intelligible.

In that regard, it notes that, as regards personal data relating to health, the GDPR specifies that the right of access of data subjects includes ‘the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided’. ( 8 ) It is because of the sensitive nature of those data that the EU legislature thus highlighted the importance of ensuring that natural persons are given access to the data contained in their medical records as fully and precisely as possible, but also in a form which is intelligible.

Regarding examination results, assessments by treating physicians and treatments or interventions provided to a patient, which, as a general rule, involve a large amount of technical data, or even images, the provision of a simple summary or a compilation of those data by the medical practitioner, in order to present them in an aggregated form, could create the risk of some relevant data being omitted or incorrectly reproduced, or, in any event, of it being made harder for the patient to verify how accurate and exhaustive those data are and to understand those data.

( 1 ) Second sentence of subparagraph 2 of Paragraph 630g of the Bürgerliches Gesetzbuch (German Civil Code).

( 2 ) More specifically, Article 12(5), Article 15(1) and (3), and Article 23(1)(i) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2) (‘the GDPR’).

( 3 ) Judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF (C‑487/21, EU:C:2023:369, paragraph 28).

( 4 ) Article 12(5) and Article 15(1) and (3) of the GDPR.

( 5 ) The first sentence of recital 63 of the GDPR states that ‘a data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing’.

( 6 ) Guaranteed in Article 15(1) of the GDPR.

( 7 ) Pursuant to Article 23(1)(i) of the GDPR.

( 8 ) Recital 63 of the GDPR.