by Laura Fannin , Geileis Garrett December-20-2023 in Commercial & Business, Data Protection
The recent Court of Justice of the European Union ruling in FT v DW (Case C307-22) provides, amongst other things, that when individuals make a data subject access request, they do not need to provide the data controller with the purpose for which they are making the request. As such, an individual is entitled to a copy of their personal data irrespective of the purpose behind making the request.
Summary
In the case of FT v DW, a patient suspected errors had been made in his dental treatment. As such, he made a data subject access request seeking his medical records with a view to triggering the liability of the dentist.
Recital 63 GDPR and Article 15 GDPR
Recital 63 of the GDPR provides that an individual has the right to access their personal data in order to be aware of and verify, the lawfulness of processing of their personal data.
The court was asked to considered whether Article 15 GDPR is to be interpreted as meaning that the doctor was not obliged to provide the patient with a copy of his personal data where he did not request the data in order to pursue the purposes referred to in Recital 63 GDPR, i.e., to become aware of the processing of his personal data and to be able to verify the lawfulness of the processing, but pursued a different purpose – one which was not related to data protection but was legitimate, in this case. to verify the existence of claims under medical liability law.
Ruling
The court held that given the importance the GDPR ascribes to the right of access of personal data undergoing processing, the exercise of that right cannot be made subject to conditions which have not been expressly laid down by EU legislature. Accordingly, the Court held that there was no requirement under Article 15 of the GDPR for a data subject to provide reasons to obtain a copy of his personal data free of charge.
Key Takeaway
The ruling of the Court of Justice of the European Union highlights the importance the GDPR, and indeed the courts, ascribe to the right of access of personal data.
Back to Full News
Share this article:
About the Authors
Laura Fannin
Laura is a partner in the Commercial & Business team at Hayes solicitors. Laura advises clients on a diverse range of corporate and commercial matters and regulatory requirements. She is an experienced adviser on terms and conditions of sale and purchase, IT issues, data protection, product liability, advertising and promotions, intellectual property and a wide range of commercial agreements.
Geileis Garrett
Geileis is a solicitor in the Commercial and Business team at Hayes solicitors. She advises on a wide range of commercial, regulatory, and contractual issues. This includes advising clients on areas of data protection compliance and reviewing, drafting, and negotiating commercial agreements.