ECJ: GDPR Right of Access for Swiss Companies

The European Court of Justice (ECJ) has ruled in its decision of October 26, 2023, in case C-307/22, on the scope of the right of access pursuant to Art. 15 para. 3 Sentence 1 in conjunction with Art. 12 para. 3 Sentence 1 GDPR. The judgment also has practical implications for Swiss companies. In addition to the revised Swiss Data Protection Act (DPA), which came into force on September 1, 2023 (the counterpart to the right of access discussed here can be found in Art. 25 DPA), Swiss companies are also obliged to comply with the data protection provisions of the GDPR when dealing with EU customer data if they operate branches in the EU or EEA (Art. 3 para. 1 GDPR, so-called “establishment principle”), if they offer goods or services in the EU or EEA (Art. 3 para. 2 lit. a GDPR, so-called “lex loci solutionis”), or if they monitor EU or EEA individuals (Art. 3 para. 2 lit. b GDPR, e.g., social media operators).

Facts of the Case

The case centered on a dispute between a German dentist and a patient over the right to a free first copy of the patient’s health data. The patient demanded that the treating dentist hand over the patient’s file free of charge. The dentist refused and referred to a national regulation according to which the costs incurred are to be borne by the patient. The plaintiff patient prevailed in the first two instances. The German Federal Court of Justice (BGH), which dealt with the case on appeal, referred the matter to the ECJ.

Reasons for the Decision

In principle, the decision concerns three questions that were decided by the ECJ:

Does the obligation to provide the first copy of personal data free of charge pursuant to Art. 12 para. 5 and Art. 15 para. 1, 3 GDPR also apply to requests for access that are not in accordance with the purposes referred to in recital 63 of the GDPR?
Does Article 23 para. 1 lit. i GDPR allow a national regulation adopted before the GDPR came into force to impose costs on the data subject for the first copy of their data to protect the economic interests of the data processor?
Does the right to a copy of personal data pursuant to Art. 15 para. 3 sentence 1 GDPR in the doctor-patient relationship include the provision of a full reproduction of all processed data to the data subject?

No obligation to justify the request to access data

The ECJ confirmed that there is no requirement under the GDPR to justify a request to access his or her personal data. The right of access covers all requests, regardless of the purpose of the request. According to Art. 12 para. 5 sentence 2 GDPR, there is a limit only in the case of manifestly unfounded and excessive requests. This means that the controller must provide an initial copy of the data free of charge, without the data subject having to justify their request in more detail. The ECJ also confirmed its established case law to the effect that preambles to an act of EU law are not binding and cannot be used for interpretation if they clearly contradict the wording of the legal acts in question.

Imposing the costs for the first copy does not comply with European law

The decision specifically concerned the national provision of Section 630g para. 2 sentence 2 German Civil Code (BGB). According to this provision, the costs incurred by the inspection of patient files must be reimbursed to the treating doctor. The provision already existed before the GDPR came into force. First, the ECJ ruled that a national provision that existed before the GDPR came into force may also be covered by the scope of application of Art. 23 para. 1 GDPR. According to this provision, national legislators can restrict Articles 12 to 22 GDPR under certain conditions. However, Article 23 para. 1 lit. i GDPR does not allow the costs of the first copy of personal data to be imposed on the data subject due to the economic interests of the processor. In this respect, Section 630g para. 2 sentence 2 BGB does not comply with the GDPR.

Right to full reproduction of all personal data

Patients have the right to receive a full copy of the documents contained in the patient file if the provision of such a copy is necessary to enable the data subject to verify the accuracy and completeness of the data and to ensure the comprehensibility of the data. This includes information such as diagnoses, examination results, findings of the attending physicians and details of treatments or interventions carried out on them. It is therefore not sufficient to simply provide a summary of the data.

Conclusion

In this decision, the ECJ maintains its consistent stance and interprets the rights of the data subject under data protection law broadly. In addition to the case decided in the doctor-patient relationship, the right to information is often also found in employee or customer relationships. In a judgement by the ECJ on January 12, 2023 (C-154/21), it has already ruled that data subjects have the right to be informed by the processor of the identity of the persons to whom the personal data has been disclosed, insofar as this is possible. The court considered the mere category of the person to be insufficient. With the decision discussed here, the ECJ once again specifies the scope of the claim and the information to be provided. The ECJ clarifies that data subjects have the right to a full reproduction of all their processed personal data. Furthermore, the ECJ states that a restriction on the free provision of the first copy by the national legislator due to the economic interests of the data processor is not covered by Art. 23 para. 1 GDPR. According to Article 12 para. 3 sentence 1 GDPR, the right to information must be fulfilled within 30 days. Companies covered by the scope of application are therefore still strongly advised to maintain a carefully managed data protection management system in which the relevant data is stored. With the entry into force of the DPA, the data protection regulations were largely adapted to the GDPR. In particular, the harmonization now also offers opportunities for companies that were previously excluded from the EU/EEA market due to the GDPR. For further information and professional advice on Swiss and cross-border data protection laws, feel free to contact us.