May 11
Danish DPA Data Protection Digital Markets Act EU-US cooperation EDPB hits Meta, the EU General Court explains the nature

CJEU rules on the right to obtain a ‘copy’ of personal data, the EU General Court opined on the pseudonymized data transmitted to a data recipient

DP News – Week 19. CJEU rules on the right to obtain a ‘copy’ of personal data, the EU General Court opined on the pseudonymized data transmitted to a data recipient.

In the judgment on the Case C-487/21, the CJEU clarified that the right to obtain a ‘copy’ of personal data envisaged under the GDPR Article 15 “means that the data subject must be given a faithful and intelligible reproduction of all those data”.

As the court further clarifies, “that right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by the GDPR, bearing in mind that account must be taken, in that regard, of the rights and freedoms of others”.

Finally, the court holds that, “the term ‘copy’ does not relate to a document as such, but to the personal data which it contains and which must be complete. The copy must therefore contain all the personal data undergoing processing”.

***

In the case T‑557/20, the EU General Court judged on the legal status of pseudonymised personal data transferred to a data recipient.

The court opined that if a data recipient lacks any additional information that would allow them to re-identify data subjects and has no legal means to obtain such information, the transferred pseudonymised data can be seen as anonymized from the recipient’s perspective, and thus not classified as personal data. It is irrelevant whether the data exporter has the ability to re-identify the data subjects, as this does not automatically make the transferred data personal for the recipient.

The court also opined on personal views and opinions considered as personal data. As the court explained, “admittedly, it cannot be ruled out that personal views or opinions may constitute personal data. However, it is apparent […] that such a conclusion cannot be based on a presumption […] but must be based on the examination of whether, by its content, purpose or effect, a view is linked to a particular person”.

See more related posts »

Related blog posts