DSARs - CJEU Clarifies What Constitutes A "Copy" Of Personal Data

The Court of Justice of the European Union ("CJEU") has delivered an important judgment in regard to the scope of the right to access under the GDPR, in particular as to what constitutes a "copy" of personal data.

Article 15(3) of the GDPR requires controllers to provide data subjects with a "copy" of their personal data, when requested. The EDPB Guidelines on Data Subject Access RequestsOpens in new window ("DSARs"), along with the DPC Guidelines on DSARsOpens in new window, both state that this does not necessarily mean that the data subject is entitled to a reproduction of the original document containing their personal data. Rather the controller is obliged to furnish to the data subject, a copy of the personal data being processed in those documents. The personal data should be provided, in a durable format, meaning in a way that is capable of being retained by the data subject in accordance with their own needs.