As law is not a static but dynamic phenomenon, and ever since these matters are of extreme importance to all inhabitants of the European Union, the right of access has been raised to the Court of Justice of the European Union (“CJEU”) as the final interpreter of EU law, which has expanded its implications. The following case law has been instrumental in outlining its application in general practice.
Joint cases C-141/12 and C-372/12:
It is noteworthy that this decision has been pre-GDPR approval. In essence, in the cases in question, National administrations via different departments initially rejected the right of access to various third-country nationals to copies of administrative documents drafted before adopting the decisions on their application for residence permits.
The core question, in terms of this article, regarding this case was whether the right of access had to be understood as providing a copy of documents in which personal data has been processed, or if it was sufficient for the Member State to provide a full summary of the personal data that has been undergone processing in the documents concerned.
The Court answered that “(…) it is sufficient for the applicant to be provided with a full summary of those data in an intelligible form, that is, a form which allows him to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him (…)[4]”.
Case C-434/16 “Nowak”[5]:
This case, resolved in 2017, is also pre-GDPR and concerns the right of access. Mr. Nowak, a trainee accountant, had initially requested to the Data Protection Commissioner in Ireland access to a corrected script of an examination at which he was a candidate. The Irish Data Protection Commissioner stated that it was not personal data. In view of this article, the core question asked to the CJEU is “Is information recorded in/as answers given by a candidate during a professional examination capable of being personal data?”
The CJEU irrevocably stated that yes, and that “the rights of access and rectification (…) may also be asserted in relation to the written answers submitted by a candidate at a professional examination and to any comments made by an examiner with respect to those answers.”
What the court did in this instance is to grant a wide scope of interpretation over the right of access of the individual.
Case C-154/21[6]:
This case was already under the GDPR’s scope and relates to an individual who asked the post office to grant him access to the personal data concerning him which were being stored or had previously been stored by the post office, and if the data had been disclosed to third parties, who the recipients were. The post office merely stated that they used such data to the extent permissible by law and referred him to a website where more information could be found. But they did not disclose the identity of the data recipients.
After raising this matter to court, the CJEU discussed the question below
“Is Article 15(1)(c) of [the GDPR] to be interpreted as meaning that the right of access is limited to information concerning categories of recipient where specific recipients have not yet been determined in the case of planned disclosures, but that right must necessarily also cover recipients of those disclosures in cases where data [have] already been disclosed?”
The court in this case confirmed that “(…) the data subject must have, in particular, the right to be informed of the identity of the specific recipients where his or her personal data have already been disclosed.”, nonetheless, the court also accepted that “(…) in specific circumstances, it is not possible to provide information about specific recipients. Therefore, the right of access may be restricted to information about categories of recipient if it is impossible to disclose the identity of specific recipients, in particular where they are not yet known.”
Case C-487/21[7]:
In this case, after a Data subject requested a copy of the information being processed by a creditworthiness data agency, the CJEU debated the extent of the term copy of the information, and how those copies should be provided. The CJEU ruled that:
“(…) the right to obtain from the controller a copy of the personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by that regulation, bearing in mind that account must be taken, in that regard, of the rights and freedoms of others.”
Case C-307/22[8]
This interesting case sheds light on medical proceedings and the obligation at all times to provide a copy of the personal data being processed. The CJEU ruled that “(…) the controller is under an obligation to provide the data subject, free of charge, with a first copy of his or her personal data undergoing processing, even where the reason for that request is not related to those referred to in the first sentence of recital 63 of that regulation.” this right also “(…)entails the right to obtain a full copy of the documents included in his or her medical records (…)”
Case C-203/22[9]:
Finally, this case which has been resolved very recently on 27th February 2025, brings very important clarity to the concept of materiality on the logic involved in the case of profiling and automatic decision making. The Court ruled that “In the case of automated decision-making, including profiling (…) the data subject may require the controller, as ‘meaningful information about the logic involved’, to explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied in order to use, by automated means, the personal data concerning that person with a view to obtaining a specific result, such as a credit profile.”
As it can be clearly seen, the CJEU keeps on interpreting and analyzing the right of access granted to data subjects to provide as much information as possible and not hinder their right to gather relevant information of theirs under processing, yet keeping in mind the balances and counterweights that must be in place to make such right actionable by the legal persons providing such information.