Rijkeboer: When the Right of Access Reaches Into the Past

Case C-553/07 | Court of Justice of the European Union | Third Chamber | 7 May 2009

Practice takeaways: ① The right of access is not limited to information about current processing; it may extend to past disclosures. ② Access is instrumental: it enables data subjects to exercise other data-protection rights and seek remedies. ③ Member States may establish retention periods for information about recipients and disclosures, but their discretion is not unlimited. ④ Retention and access periods must strike a fair balance between the data subject’s interests and the burden on the controller. ⑤ A one-year period was not a fair balance where the underlying personal data were retained much longer, unless longer retention of disclosure information would impose an excessive burden.

Rijkeboer asked a deceptively simple question: how far back must the right of access reach?

Dutch law allowed an individual to learn who had received his personal data—but only for disclosures made during the preceding year. The CJEU held that access cannot necessarily stop there. Because access enables individuals to verify processing and exercise rights such as rectification, erasure, objection, and judicial remedies, it must be capable of reaching into the past. A retention rule that makes those rights ineffective may violate EU data-protection law.

What happened

Mr Rijkeboer asked the Rotterdam municipal authorities to identify everyone to whom information about him had been disclosed during the previous two years, including the content of those disclosures. He was particularly interested in learning who had received his former address. (Judgment, para. 23.)

The municipality provided information for only the preceding year. Dutch law required records of disclosures to be retained for one year, and older disclosure records had been automatically erased. (Judgment, paras. 20–21, 24–25.)

The Dutch Raad van State therefore asked whether limiting access to the preceding year was compatible with Article 12(a) of the Data Protection Directive, considered together with the storage-limitation rule in Article 6(1)(e) and proportionality. (Judgment, paras. 28–31.)

Why the case matters

Rijkeboer treats access as more than a right to receive information. Access is what makes other data-protection rights usable.

A person who cannot discover that their information was improperly disclosed may be unable to seek correction, erasure, blocking, notification of recipients, objection, judicial relief, or compensation. That is why the Court concluded that access to information about recipients must, by necessity, extend into the past. (Judgment, paras. 49–54.)

The important qualification is that Rijkeboer did not establish an unlimited historical right of access. Instead, it required a fair balance between effective data-subject rights and the burden imposed on controllers by retaining historical disclosure information. (Judgment, paras. 56–66.)

Key holding

The Court reached three connected conclusions.

• Access must be capable of reaching into the past. Otherwise, individuals could not effectively exercise rights concerning unlawful or inaccurate processing or pursue legal remedies. (Judgment, paras. 51–54.)
• Member States may set time limits, but their discretion is not unlimited. The period must allow data subjects effectively to exercise the rights protected by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46 or the Data Protection Directive.) (Judgment, paras. 56–57.)
• One year was not a fair balance in these circumstances where the underlying personal data were retained much longer—unless longer retention of the disclosure history would impose an excessive burden on the controller. (Judgment, paras. 64–66.)

The Court’s analysis

1. Access serves other data-protection rights

The Court began with the purpose of access. Individuals must be able to verify that their personal data are accurate, lawfully processed, and disclosed only to authorized recipients. (Judgment, paras. 46–50.)

Access also enables the exercise of other rights: rectification, erasure or blocking; notification of recipients; objection to processing; and judicial remedies and compensation. (Judgment, paras. 51–52.)

2. That means access must reach into the past

Article 12 did not expressly specify how far into the past access had to extend. But the Court concluded that the right “must of necessity relate to the past.” (Judgment, para. 54.)

Otherwise, a person could lose the practical ability to challenge unlawful or inaccurate processing simply because the record showing what happened had disappeared. (Judgment, paras. 53–54.)

This is the core of Rijkeboer: the effectiveness of the underlying rights helps determine the required scope of access.

3. But historical access is not unlimited

The Court nevertheless recognized that retaining disclosure histories indefinitely could impose substantial burdens, particularly where disclosures are frequent or involve many recipients. The Data Protection Directive did not require controllers to bear disproportionate burdens. (Judgment, paras. 56–63.)

Member States could therefore establish retention periods. Relevant considerations could include the sensitivity of the underlying data, how long those data were retained, the number of recipients, applicable limitation periods for legal actions, and the burden on the controller. (Judgment, paras. 58–63.)

4. One year was too short unless longer retention was excessively burdensome

The problem was the mismatch.

Rotterdam could retain Mr Rijkeboer’s underlying personal data for a long period while keeping information about who received those data and what was disclosed for only one year. The Court held that this did not constitute a fair balance unless longer retention of the disclosure information would impose an excessive burden on the controller. (Judgment, paras. 64–66.)

The national court was responsible for making that factual determination. (Judgment, para. 66.)

The Advocate General’s Opinion

Advocate General Ruiz-Jarabo Colomer framed the case as a tension within data protection itself: deleting data protects individuals, but deleting the history of how those data were used can prevent them from discovering and challenging past processing. (Opinion, paras. 2, 23–28.)

He treated access as a “basic pillar” of the Directive because it enables individuals to verify whether processing was lawful and enforce their rights. He therefore considered deletion secondary to access and viewed information about past disclosures as part of the protected data-processing record. (Opinion, paras. 29–45.)

For him, a one-year limit could be disproportionate—particularly where the individual had not been told about the disclosure, the access period, or the recipients. Because a fundamental right was at stake, he would place the burden on the controller to justify such a short period. (Opinion, paras. 64–73.)

The Court ultimately adopted a more flexible fair-balance test, weighing effective access against the burden that longer retention would impose on the controller.

What the Court did—and did not—decide

The Court did decide that the right of access to recipient and disclosure information must extend into the past sufficiently to make the data subject’s rights effective, and that a one-year limit was not a fair balance on the facts presented unless longer retention would impose an excessive burden.

It did not establish a universal retention period, require indefinite preservation of disclosure histories, or hold that recipient information must always be retained for exactly as long as the underlying personal data. The Court deliberately left Member States room to balance effective access against proportionality and controller burden.

Rijkeboer under today’s GDPR

Rijkeboer interpreted Directive 95/46, not the General Data Protection Regulation (GDPR.) But its basic logic remains highly relevant—particularly at the intersection of the GDPR’s right of access and storage-limitation principle.

Article 15 GDPR now expressly gives individuals access to information about “the recipients or categories of recipient” to whom their personal data have been or will be disclosed. More broadly, access allows individuals to understand how their data is being used and provides the foundation for exercising other rights, including rectification, erasure, restriction, and objection. For more on that framework, see What is the “Right of Access” under the GDPR?

At the same time, Article 5(1)(e) GDPR requires personal data to be kept no longer than necessary for the purposes of processing. Retention periods therefore must be justified by purpose rather than imposed indefinitely “just in case.” See What does “storage limitation” mean under the GDPR?

That does not mean, however, that longer retention is inherently preferable. In Digital Rights Ireland, the Court emphasized the opposite side of the proportionality equation: retention of communications metadata is itself an interference with privacy and data-protection rights, and retention periods must be objectively justified rather than imposed indiscriminately. Ministerio Fiscal later reinforced that proportionality depends on what the particular data can actually reveal: more revealing data create a more serious interference and demand correspondingly stronger justification.

Those cases arise in a very different context—government access to retained communications data under the ePrivacy Directive and the Charter—and should not be read as determining how long an ordinary GDPR controller must retain disclosure records. But they reinforce the broader point relevant to Rijkeboer: retention is itself processing, and proportionality operates in both directions. Data should not be retained longer than justified, but neither should information necessary to make a statutory right effective disappear before that right can realistically be exercised.

Rijkeboer therefore does not establish a general rule that disclosure logs must be retained for as long as the underlying personal data. It instead requires a balance between competing considerations:

Retention periods must not be so short that the right of access becomes ineffective, while continued retention must itself remain justified and proportionate in light of the circumstances of the processing.

Conclusion

Rijkeboer makes the right of access practical rather than merely formal.

If information necessary to understand past processing disappears too quickly, the individual may lose the ability to challenge that processing at all. Member States may impose limits, but those limits must preserve a fair balance between effective data-subject rights and the burden on the controller.

Put simply: a right to know what happened to your data is not very useful if the records disappear before you can ask.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. Cases can be located by searching the case name or case number (C-553/07).

• Court of Justice of the European Union, Third Chamber, Case C-553/07, College van burgemeester en wethouders van Rotterdam v M.E.E. Rijkeboer, Judgment of 7 May 2009, ECLI:EU:C:2009:293.
• Opinion of Advocate General Dámaso Ruiz-Jarabo Colomer, Case C-553/07, Rijkeboer, delivered 22 December 2008, ECLI:EU:C:2008:773.

Useful reading from The De La Torre Review

• “What Is the ‘Right of Access’ Under the GDPR?” An overview of Article 15 GDPR, including the right to obtain information about recipients, a copy of personal data undergoing processing, and the relationship between access and other data-subject rights. It provides the modern GDPR framework for the right at the center of Rijkeboer. Read the Article. Read the Article.
• “What Does ‘Storage Limitation’ Mean Under the GDPR?” A closer look at the principle that personal data should not be retained longer than necessary and the need to establish justified retention periods. It provides the other side of the tension in Rijkeboer: preserving enough information to make access effective without retaining data unnecessarily. Read the Article.
• “Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.” A later CJEU decision examining the opposite side of the retention problem: the fundamental-rights consequences of retaining communications metadata too broadly or for periods that are not objectively justified. Although it arose in the surveillance context, it illustrates why retention itself must satisfy proportionality. Read the Article.
• “Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story.” Ireland provides a useful contrast to Rijkeboer. While Rijkeboer considered how long information must remain available so that a data subject’s right of access remains effective, Ireland concerned mandatory retention of communications metadata for eventual law-enforcement purposes. Together, the cases illustrate why retention cannot be evaluated in the abstract: its legal significance depends on its purpose, context, and the interests or rights the retention serves. Read the Article.
• "Bavarian Lager: When Transparency Requests Become Data-Protection Questions." Bavarian Lager illustrates the other side of access rights. While Rijkeboer emphasizes the information a data subject may need to exercise the right of access effectively, Bavarian Lager shows that a right of access to information does not automatically extend to third-party personal data contained within it. Those data remain independently subject to data-protection requirements. Read the Article.
• “Ministerio Fiscal: Not All Access to Communications Data Is Equally Intrusive.” A later CJEU judgment refining the proportionality analysis for access to retained communications data. The Court emphasized that the seriousness of an interference depends on what the particular data can reveal—useful context for understanding why retention and access cannot be assessed in the abstract. Read the Article.
• "CRIF: When a “Copy” of Your Personal Data Requires More Than a Data List." Develops the Court’s access-rights jurisprudence under the GDPR. Like Rijkeboer, CRIF focuses on making access effective: the data subject must receive information in a form that allows the processing to be understood and relevant rights to be exercised. CRIF adds that this may require document or database context where necessary to make the personal data intelligible. Read the Article.
• Nowak: When an Exam Answer Becomes Personal Data — Complements Rijkeboer’s analysis of the right of access by addressing the logically prior question of what information qualifies as personal data. Nowak explains that information may relate to an individual through its content, purpose, or effect, helping define the information to which data-subject rights may attach. Read the Article.