Court decision · 4 May 2023
F.F. v Österreichische Datenschutzbehörde (CRIF)
Case C-487/21, ECLI:EU:C:2023:369 · Court of Justice of the European Union
What it means for your code
An export endpoint that emits a tidy summary is not enough: a DSAR export has to be complete and readable enough for the person to verify it, which usually means the underlying records, not a rendered view.
What happened
A credit agency answered a subject access request with a summary table rather than the underlying material, and the requester asked what a 'copy' of his data actually means.
What was decided
A copy means a faithful and intelligible reproduction of all the data being processed, which may require handing over extracts, whole documents or database records where that is what makes the data understandable and lets the subject check its accuracy.
The legal test applied
- A 'copy' under Art. 15(3) means a faithful and intelligible reproduction of the data undergoing processing
- Extracts, whole documents or database records must be provided where that is what makes the data intelligible
- The obligation is limited to the data actually being processed, not every document mentioning the subject
What would have changed the outcome
- A summary suffices where it is genuinely complete and intelligible
- Rights of others may justify redaction but not refusal
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.