CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List

Case C-487/21 | F.F. v Österreichische Datenschutzbehörde, CRIF GmbH | Court of Justice of the European Union | First Chamber | 4 May 2023

Practice Takeaways: ① A “copy” must reproduce the personal data. A general description or list of data categories is not enough. ② The right is to the data—not necessarily the documents. Article 15 does not automatically entitle individuals to copies of every document containing their data. ③ Context may need to be provided. Document or database extracts—and sometimes entire documents—may be required when necessary to understand the data. ④ Generated information counts too. Personal data can include information created through processing, such as a creditworthiness assessment. ⑤ Access must be meaningful. The response should allow individuals to understand and verify the processing and exercise their GDPR rights. ⑥ The rights of others still matter. Access must be balanced against third-party rights, including trade secrets and intellectual property.

Article 15 GDPR gives data subjects a right to obtain a copy of their personal data undergoing processing. But does that mean a controller can simply extract the data into a summary—or must it sometimes provide the emails, database extracts, or other documents in which those data appear?

In CRIF, the Court held that the copy must be a faithful and intelligible reproduction of all the personal data undergoing processing. The right is to the personal data, not automatically to the documents containing them. But where the surrounding document or database context is necessary to make the data intelligible and allow the data subject to exercise GDPR rights effectively, Article 15 may require extracts—or even entire documents.

That distinction makes CRIF one of the Court’s most practically important interpretations of the GDPR right of access.

Practice Tip: A controller responding to an Article 15 request should not ask only, “Have we exported every data field?” It should also ask, “Can the data subject actually understand what these data mean in the context in which we process them?” If not, additional context may be required.

What happened

CRIF GmbH (CRIF) is a business consulting agency that provides clients with information about the creditworthiness of third parties. It processed personal data concerning F.F. (the individual whose personal data CRIF processed for creditworthiness purposes) for that purpose. (Judgment, para. 9.)

In December 2018, F.F. exercised his right of access under Article 15 GDPR. In addition to requesting access to his personal data, he asked CRIF to provide copies of the documents containing those data—including emails and database extracts—in a standard technical format. (Judgment, para. 10.)

CRIF responded with a summary list of the personal data it was processing. It did not provide the underlying emails, database extracts, or other documents. (Judgment, para. 11.)

F.F. complained to the Austrian Data Protection Authority (DSB), arguing that Article 15 entitled him to copies of those materials. The authority rejected the complaint, concluding that CRIF had not infringed his right of access. (Judgment, paras. 12–13.)

F.F. then brought an action challenging the DSB's decision before the Bundesverwaltungsgericht (Federal Administrative Court.)

The Austrian Federal Administrative Court was therefore faced with a basic interpretive problem: What did the GDPR legislature mean when it said that a controller must provide a “copy of the personal data undergoing processing”? Was a summary enough? Did “copy” mean the underlying documents themselves? Or did the answer depend upon what was necessary to understand the data? (Judgment, paras. 14–18.)

Why the case matters

CRIF draws an important distinction between data and documents.

Article 15 is not a document-discovery mechanism. A data subject does not acquire a general right to every email, file, or database record in which their personal data happen to appear.

But neither may a controller reduce the right of access to an abstract inventory of isolated data points.

The Court connected the form of disclosure to the function of the access right. Access exists so that individuals can understand what is being processed, determine whether their data are accurate and lawfully processed, and, where appropriate, exercise the GDPR’s other rights. (Judgment, paras. 33–39.)

That means context sometimes matters.

A name, code, score, database field, assessment, or derived value may be technically reproduced accurately yet remain impossible to understand without seeing how it appears in the underlying record. In those circumstances, providing the surrounding material may be necessary to make the “copy” meaningful.

The question is therefore not whether a document contains personal data. It is whether providing some or all of that document is necessary to give the data subject a faithful and intelligible copy of the personal data.

Key holding

The Court held that Article 15(3) requires a faithful and intelligible reproduction of all personal data undergoing processing. (Judgment, paras. 28, 39, 45.)

That does not create a general right to copies of the documents containing those data. Article 15(3) concerns the personal data themselves, and the “copy” requirement specifies the form in which the Article 15 access right must be fulfilled rather than creating a separate document-access right. (Judgment, paras. 29–32.)

But document extracts, database extracts, and sometimes entire documents must be provided where doing so is essential to make the personal data intelligible and enable the data subject effectively to exercise GDPR rights. (Judgment, paras. 39–45.)

The Court’s analysis

1. A “copy” must faithfully reproduce the personal data

The GDPR does not define “copy.” The Court therefore began with its ordinary meaning: a faithful reproduction or transcription of an original.

That immediately ruled out one possible interpretation. A purely general description of the personal data being processed—or simply identifying categories of data—does not constitute a copy. (Judgment, paras. 20–21.)

At the same time, what must be copied is important. Article 15(3) says “personal data undergoing processing,” not “documents containing personal data.” (Judgment, paras. 20–22.)

The result is a right to a faithful reproduction of the personal data themselves, understood broadly. (Judgment, para. 28.)

2. Personal data include information generated through processing

The Court then connected Article 15 to the GDPR’s deliberately broad definition of personal data.

“Personal data” encompass potentially all kinds of information relating to an identified or identifiable person, including objective information and subjective opinions or assessments. Information relates to a person where its content, purpose, or effect links it to that individual. (Judgment, paras. 22–25, citing Nowak.)

That was particularly significant in CRIF. The Court explained that personal data include not only information collected and stored by a controller but also information resulting from processing, giving as examples an assessment of a person’s creditworthiness or ability to pay. (Judgment, para. 26.)

Practice Tip: Derived data is personal data too. Article 15 access is not limited to information originally collected from the individual. Information generated through processing—such as assessments, scores, recommendations, or conclusions about a person—may itself constitute personal data and must be included in the access response when it relates to the data subject.

The right to a copy therefore reaches the personal data produced by the processing—not merely the raw information originally supplied or collected. (Judgment, paras. 26–28.)

3. Article 15 creates a right to data, not a general right to documents

The Court nevertheless rejected the proposition that Article 15(3) transforms the GDPR access right into a general right of access to documents.

Article 15(1) establishes the subject matter and scope of the access right. Article 15(3) specifies the practical manner in which the controller must provide the personal data—namely, as a “copy.” It does not create a separate access right. (Judgment, paras. 30–32.)

As the Court put it, the word “copy” relates not to the document as such, but to the personal data contained in it. (Judgment, para. 32.)

4. But sometimes the document is necessary to understand the data

The Court then added the qualification that gives CRIF much of its practical significance.

The access right must actually work.

Its purpose is to allow the data subject to verify whether personal data are accurate and lawfully processed and, where appropriate, exercise rights of rectification, erasure, restriction, objection, or judicial redress. (Judgment, paras. 33–35.)

Article 12’s transparency requirement likewise requires information to be concise, accessible, understandable, and expressed in clear and plain language. (Judgment, paras. 36–38.)

A copy must therefore contain the characteristics necessary for those rights to be exercised effectively. It must reproduce the data fully and faithfully. (Judgment, para. 39.)

And sometimes that cannot be accomplished by extracting isolated data fields.

"the context in which the data are processed is an essential element in enabling the data subject to have transparent access" (Judgment, para. 42.)

Where contextualization is necessary to make personal data intelligible, the controller may have to reproduce extracts from documents, extracts from databases, or even entire documents. The Court specifically noted that context can be essential where personal data are generated from other data or even where an empty field—the absence of information—itself conveys information about the data subject. (Judgment, paras. 41–42.)

Practice Tip: Context can be part of meaningful access. Do not assume that exporting isolated data fields will always satisfy Article 15. Where the surrounding context is necessary to understand the personal data, the response may need to include document extracts, database extracts, or even entire documents.

5. Access must still respect the rights of others

The right is not unlimited.

Article 15(4) provides that the right to obtain a copy must not adversely affect the rights and freedoms of others, including trade secrets, intellectual property, and copyright protecting software. (Judgment, para. 43.)

But that is not necessarily an all-or-nothing limitation. Where access conflicts with the rights of others, the competing interests must be balanced. Wherever possible, the controller should choose a means of disclosure that permits access without infringing those other rights rather than refusing the information altogether. (Judgment, para. 44.)

The Advocate General’s Opinion

Advocate General Giovanni Pitruzzella reached substantially the same conceptual result.

He emphasized that a “copy” must faithfully reproduce the personal data and allow the data subject to understand all personal data undergoing processing. The form could vary depending upon the nature of the data: paper, electronic records, audio, video, or another format might each constitute an appropriate copy. What matters is fidelity and intelligibility. (Opinion, paras. 43–45.)

He also stressed that the access right extends beyond data collected by the controller to new personal data generated through processing. In the credit-reporting context, he specifically identified a recommendation concerning an individual’s creditworthiness and willingness to pay as information capable of constituting personal data. (Opinion, paras. 37–39.)

But the Advocate General likewise rejected a general right to underlying documents. Providing the document itself is not invariably necessary. It becomes necessary where the document or database context is indispensable to making the personal data fully intelligible. (Opinion, paras. 63–70.)

The Court largely followed that approach.

What the Court did—and did not—decide

The Court did hold that a controller must provide all personal data undergoing processing in a faithful and intelligible form.

It did hold that information generated through processing—such as an assessment of creditworthiness—can itself constitute personal data subject to access.

And it did hold that document extracts, database extracts, or even entire documents may have to be provided where context is essential to understanding those data and effectively exercising GDPR rights.

But the Court did not establish a general GDPR right to obtain copies of every document mentioning the data subject.

It did not equate “copy of the personal data” with “copy of the document.”

And it did not hold that third-party rights disappear when Article 15 is invoked. Those rights remain part of the analysis under Article 15(4).

Conclusion

CRIF makes the GDPR right of access both broader and narrower than a simple demand for documents.

It is narrower because Article 15 is fundamentally a right to personal data, not a general discovery right to the files in which those data happen to reside.

But it is broader than a right to receive a spreadsheet of isolated data points.

The controller must provide a faithful and intelligible reproduction of all personal data undergoing processing. And where the meaning of those data depends on their context, the context may have to come with them.

That is the practical lesson of CRIF: the adequacy of an access response depends not simply on whether the data were produced, but on whether the data subject can understand them well enough to exercise the rights the GDPR gives them.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The case can be located using Case C-487/21, F.F. v Österreichische Datenschutzbehörde, CRIF GmbH.

• Court of Justice of the European Union, First Chamber, Case C-487/21, F.F. v Österreichische Datenschutzbehörde, CRIF GmbH, Judgment of 4 May 2023, ECLI:EU:C:2023:369.
• Opinion of Advocate General Giovanni Pitruzzella, Case C-487/21, delivered 15 December 2022, ECLI:EU:C:2022:1000.

Useful reading from The De La Torre Review

• What Is the “Right of Access” under the GDPR? — A practical guide to Article 15 and Subject Access Requests, providing the broader framework for the right interpreted in CRIF, including what information controllers must provide and the limits imposed by the rights and freedoms of others. Read the Article
• Bavarian Lager: When Transparency Requests Become Data-Protection Questions — Examines the related problem from the opposite direction: when a right to obtain information or documents encounters the personal data of other individuals. CRIF similarly emphasizes that access rights must be reconciled with the rights and freedoms of others. Read the Article
• Nowak: When an Exam Answer Becomes Personal Data — Provides an important foundation for CRIF’s broad understanding of personal data. CRIF relies on Nowak in explaining that personal data may include objective and subjective information, including opinions and assessments, where the information relates to an identifiable person. Read the Article
• Rijkeboer: When the Right of Access Reaches Into the Past — An earlier examination of the function of the right of access and the information necessary to allow individuals to understand how their personal data have been processed. Read the Article