On 4 May 2023, the European Court of Justice
("ECJ") delivered a preliminary ruling
in the case of F.F. v Österreichische Datenschutzbehörde
(C-487/21), in relation to the interpretation of Article 15 of
Regulation (EU) 2016/679 (the "GDPR") on
a data subject's right of access to his/her data undergoing
processing.
Background to the proceedings before the Federal Administrative
Court of Austria
CRIF GmbH ("CRIF"), a business
consultancy agency, was involved in the business of providing, at
the request of its clients, information on the creditworthiness of
third parties. As part of its business, CRIF had processed the
personal data of the applicant. In December 2018, the applicant
applied to CRIF, on the basis of Article 15 of the GDPR, for access
to the personal data concerning him. The applicant also requested
CRIF to provide him with a copy of the documents concerning his
data, namely emails and database extracts, in a standard technical
format. In response
