CJEU Advocate General delivers Opinion on the right of access for purposes unrelated to data protection
On April 20th, 2023, the Advocate General of the Court of Justice of the European Union (CJEU), Nicholas Emiliou, released his opinion in the case FT v DW (C-307/22). The AG suggested that Articles 12(5) and 15(3) of the General Data Protection Regulation (GDPR) require companies to provide personal data copies to individuals, regardless of why it was requested. Such decision could have huge reverberations for any potential civil claims for damages against corporations. This view is consistent with an emerging trend amongst both regulators and courts towards a wide interpretation of the access right.
In this case, a patient at a dental practice who suspected a treatment error requested that the practice provide him with free copies of all medical records related to him in their possession. The dental practice declined such request unless the patient covered the associated costs.
The Local Court granted the patient’s claim. Upon appeal by the dentist, the Regional Court sustained the decision. During their reasoning, they stated that the right of access under Article 15(3) of the GDPR was not revoked under the circumstances that the patient requested information for an examination of medical liability claims.
The dentist then sought further legal action at the German Federal Court of Justice which stayed proceedings and referred questions to the CJEU for preliminary ruling. Primarily, they questioned whether Articles 12(5) and 15(3) GDPR implied that controllers were not obligated to offer the data subject with their initial copy of personal data at no cost if such a request was not connected to data protection. Additional queries inquired about the costs for such information due to national law and if the person should receive a complete version of the patient file.
