Court decision · 22 June 2023
J.M. v Finnish Data Protection Ombudsman and Pankki S
Case C-579/21, ECLI:EU:C:2023:501 · Court of Justice of the European Union
What it means for your code
Access logs are disclosable material. Record who-viewed-what with a purpose and a timestamp, keep the logs separable from staff identity, and be able to hand a customer their own access history.
What happened
A bank employee and customer asked who inside the bank had looked at his customer records and when.
What was decided
The right of access covers information about the consultation operations themselves — the dates and purposes of access — but does not extend to the identity of the employees who carried them out, unless that is indispensable to allow the subject to exercise their rights.
The legal test applied
- Consultation operations — dates and purposes of access — are information about the processing and fall within Art. 15
- The identity of the employees who consulted the data is not covered unless indispensable to exercising rights
- The controller's dual role as employer does not change the analysis
What would have changed the outcome
- Where the access itself is the alleged wrong, identity may become indispensable
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.