Must the first sentence of Article 15(3) of [the GDPR], read in conjunction with Article 12(5) thereof, be interpreted as meaning that the controller (in the present case: the doctor providing treatment) is not obliged to provide the data subject (in the present case: the patient), free of charge, with a first copy of his or her personal data processed by the controller where the data subject does not request the copy in order to pursue the purposes referred to in the first sentence of recital 63 of the GDPR, namely to become aware of the processing of his or her personal data and to be able to verify the lawfulness of that processing, but pursues a different purpose – one which is not related to data protection but is legitimate (in the present case: to verify the existence of claims under medical liability law)?

The controller must provide a first copy of personal data free of charge, irrespective of the request's purpose.

In accordance with Article 23(1)(i) of the GDPR, can a national provision of a Member State adopted prior to the entry into force of the GDPR also be regarded as a restriction of the right to be provided, free of charge, with a copy of the personal data processed by the controller, as provided for in the first sentence of Article 15(3) of the GDPR, read in conjunction with Article 12(5) thereof?

National legislation cannot impose costs on the first data copy, as it undermines the GDPR's right to free access.

In the context of the doctor-patient relationship, does the entitlement under the first sentence of Article 15(3) of the GDPR include entitlement to be provided with copies of all parts of the patient’s medical records containing the patient’s personal data, or does it extend only to the provision of a copy of the patient’s personal data as such, with the doctor who processes the data deciding the manner in which he or she compiles the data for the patient concerned?

The right includes obtaining a full copy of medical records if necessary for understanding and verifying data accuracy.

First copy of personal data must be provided free of charge under GDPR, regardless of request purpose.

European Court of Justice (First Chamber) · 26 oktober 2023 · Judgment · Preliminary ruling

(Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 12, 15 and 23 – Data subject’s right of access to his or her data undergoing processing – Right to obtain a first copy of those data free of charge – Processing of a patient’s data by his or her medical practitioner – Medical records – Reasons for the request for access – Use of data for the purpose of triggering the liability of the person providing treatment – Concept of ‘copy’)

Rechtsvraag

Does the GDPR obligate controllers, such as medical practitioners, to provide a first copy of personal data undergoing processing free of charge, even if the request is made for reasons not related to verifying the lawfulness of data processing? Additionally, can national legislation require patients to bear the cost of such a copy, and what is the scope of the right to obtain a copy of personal data in the context of a doctor-patient relationship?

Regel

Article 12(5), GDPR (The controller must provide information free of charge unless requests are manifestly unfounded or excessive)
Article 15(1) and (3), GDPR (Data subjects have the right to access personal data and obtain a first copy free of charge)
Article 23(1)(i), GDPR (Union or Member State law may restrict the rights provided for in Articles 12 to 22 if necessary and proportionate to protect the rights and freedoms of others)

Conclusie

The court concluded that under GDPR, the controller is obligated to provide the data subject with a first copy of personal data undergoing processing free of charge, regardless of the reason for the request. National legislation cannot require the data subject to bear the costs of this first copy if it only aims to protect the economic interests of the controller. The right to obtain a copy means receiving a faithful and intelligible reproduction of all data, including full medical records if necessary for verifying data accuracy and comprehensibility.

Tijdlijn

29-03-2022 The Bundesgerichtshof (Federal Court of Justice, Germany) made a decision to request a preliminary ruling from the Court of Justice of the European Union.
10-05-2022 The Court of Justice of the European Union received the request for a preliminary ruling from the Bundesgerichtshof.
20-04-2023 The Advocate General presented their opinion at the sitting of the Court.
26-10-2023 The Court of Justice of the European Union delivered its judgment regarding the interpretation of specific articles of the GDPR in the context of the case between FT and DW.
Unknown DW initiated legal proceedings against FT, a dentist, due to FT's refusal to provide a first copy of medical records free of charge.
Unknown DW, suspecting errors in dental treatment, requested FT to provide a first copy of his medical records free of charge.
Unknown FT refused DW's request for a free copy of medical records, citing national law requiring cost reimbursement.
Unknown DW's request to receive a free copy of his medical records was upheld by both the first instance and appeal courts.