by Laura Fannin , Geileis Garrett December-20-2023 in Commercial & Business, Data Protection

The recent Court of Justice of the European Union ruling in FT v DW (Case C307-22) provides, amongst other things, that when individuals make a data subject access request, they do not need to provide the data controller with the purpose for which they are making the request. As such, an individual is entitled to a copy of their personal data irrespective of the purpose behind making the request.


In the case of FT v DW, a patient suspected errors had been made in his dental treatment. As such, he made a data subject access request seeking his medical records with a view to triggering the liability of the dentist.

Recital 63 GDPR and Article 15 GDPR

Recital 63 of the GDPR provides that an individual has the right to access their personal data in order to be aware of and verify, the lawfulness of processing of their personal data.

The court was asked to considered whether Article 15 GDPR is to be interpreted as meaning that the doctor was not obliged to provide the patient with a copy of his personal data where he did not request the data in order to pursue the purposes referred to in Recital 63 GDPR, i.e., to become aware of the processing of his personal data and to be able to verify the lawfulness of the processing, but pursued a different purpose – one which was not related to data protection but was legitimate, in this case. to verify the existence of claims under medical liability law.


The court held that given the importance the GDPR ascribes to the right of access of personal data undergoing processing, the exercise of that right cannot be made subject to conditions which have not been expressly laid down by EU legislature. Accordingly, the Court held that there was no requirement under Article 15 of the GDPR for a data subject to provide reasons to obtain a copy of his personal data free of charge.

Key Takeaway

The ruling of the Court of Justice of the European Union highlights the importance the GDPR, and indeed the courts, ascribe to the right of access of personal data.



Back to Full News