CJEU interprets right of inspection broadly, more broadly than is usually the case in the Netherlands to date
Dispute following inspection request The issue concerns a dispute between a consumer and the privacy regulator in Austria. The consumer had made an inspection request to a business consultancy firm that issues reports on creditworthiness (solvency). In response, the consumer had been provided with an overview of the personal data processed, without any underlying documents. The consumer believed he was also entitled to the underlying documents and filed a complaint with the supervisor. The supervisor rejected the complaint. Thereupon, the consumer went to court. The Austrian court then referred questions to the Court of Justice. Court of Justice: broad scope of many concepts The matter thus ended up before the Court of Justice. The question here is basically how broadly the right of inspection should be interpreted. The ECJ first of all emphasized that many concepts in the AVG have a broad scope:
the notion of personal data extends to any kind of information, both objective information and subjective information provided that this information "concerns" the data subject, which is in any case the case when the information, by reason of its content, purpose or effect, relates to an identifiable person (see earlier judgment Exam Results); the concept of processing is also broadly defined with a non-exhaustive list of acts (citing Latvian tax issue).
It is these broad notions that define the "scope" of what the right of inspection covers.
Court of Justice: copy is more than description The right of inspection entitles the data subject to a copy of personal data. The Court notes that the AVG does not contain a definition of the term copy. Hence, it looks at the linguistic meaning and purpose and scope of the provision. The Court first notes that a copy is a reproduction and that general descriptions are not sufficient: (…) refers to the faithful reproduction or transcription of an original, so that a purely general description of the data being processed or a reference to categories of personal data does not meet that definition. At the same time, the Court also notes that, according to the letter of the AVG, the right to a copy of personal data refers to just that: a copy of personal data. It cannot already be directly inferred from Article 15(3) AVG that there is a right to a copy of documents containing personal data. Court of Justice: broader interpretation given context provision The Court of Justice went on to point out that there are all kinds of indications that mean that the right of inspection must be interpreted broadly in many circumstances:
the AVG was intended to strengthen the rights of data subjects; the Privacy Directive only gave the right to a disclosure of processed data, while the AVG explicitly speaks of a copy of that data; the right of inspection is intended, among other things, to be able to determine whether p (Machine translated)