Data Subject Access Requests Right To A "Copy" Of Personal Data, CJEU Ruling

On 4 May 2023, the CJEU provided a preliminary ruling for Case C-487/21, in which the Austrian Court sought guidance on the scope of information accessible to data subjects under the right to access a copy of personal data, as provided for by Article 15(3) of the General Data Protection Regulation ("GDPR").

CJEU rulings are binding within the EU and no longer in the UK (though UK organisations may need to adhere to them, when the extraterritorial provisions of the EU's GDPR apply).

The Austrian Court approached the CJEU with uncertainty as to the applicable scope of Article 15(3), requesting clarity in relation to two sentences of the provision:

1. The meaning of "copy" in the first sentence of Article 15(3):