The CJEU in Joined Cases C-141/12 and C-372/12 has clarified the scope of a data subject’s right of access to a copy of their personal data. The CJEU’s ruling may serve to lighten the burden of access requests on organisations. It confirms that the Data Protection Directive 1995 (the Directive) does not establish a right of access to any specific document or file in which personal data are listed or used, nor does it specify the material form in which personal data must be made accessible. Member States enjoy a margin of discretion to determine the form in which to make personal data accessible, so long as it is intelligible. Accordingly, the CJEU found that the Dutch authorities, in this case, had met their legal obligations under data protection law by extracting from the relevant documents the personal data relating to the data subject.
The applicants were three third-country nationals who applied for residence permits in the Netherlands. They made data access requests for a copy of the full minute containing the legal analysis that underpinned the decisions by the Dutch authorities regarding their permit applications. Although a summary of the personal data in the minute was provided to one applicant, a copy of the full minute was denied to all three applicants.
The Netherlands’ courts asked the CJEU whether the data in the minute concerning the data subject constituted personal data within the meaning of Article 2(a) of the Directive; whether the legal analysis contained in the minute constituted personal data within the meaning of Article 2(a) of the Directive; whether Article 12(a) of the Directive and Article 8(2) of the Charter of Fundamental Rights of the European Union meant that there was a right to a copy of the minute or whether it was sufficient to provide a summary, in intelligible form, of the personal data.
The CJEU held that a legal analysis of an applicant’s entitlement to lawful residence, contained in an administrative document (such as the ‘minute’ at issue in the main proceedings) was not ‘personal data’ within the meaning of Article 2(a) of the Directive. Therefore the applicant should not be granted access to that part of the minute.
However, the CJEU held that there was no doubt that the data relating to the application for a residence permit contained in the minute, such as the applicant’s name, date of birth, nationality, gender, ethnicity, religion and language, constituted information relating to the applicant, and was therefore ‘personal data’. The CJEU found that for the right of access in Article 12(a) and Article 8(2) of the Charter to be complied with, it was sufficient that the applicant be provided with a full and comprehensive summary of those data in an intelligible form, that is, a form which would allow the applicant to become aware of those data and to check that they were accurate and processed in compliance with the Directive. The data subject cannot derive from either Article 12(a) of the Directive or Article 8(2) of the Charter the right to obtain a copy of the document or the original file in which those data appear.