1. CASE FACT
In view of divorce proceedings, a husband had made numerous audio recordings of the couple’s arguments without his wife’s knowledge, both on his phone and laptop. Further, he had made copies of their What’s-App-Chat-history and text messages and had access to his wife’s email account via a “sub-account”.
In October 2019, his wife (as data subject) made a written access request, in which she also demanded copies of her personal data processed by her husband, in particular copies of all emails and all saved contacts belonging to her email account as well as copies of the audio recordings. Her husband, however, claimed that the household exemption (Art 2 para 2 lit c GDPR) was applicable and answered his wife’s request with a negative report.
His wife then filed a complaint with the data protection authority claiming, inter alia, that her right to access pursuant to Art 15 GDPR had been violated.
2. DECISION
Since the husband had argued that the only purpose of processing the text/What’s-App-messages and audio recordings was to potentially use the data to enforce his civil claims in the course of the divorce proceedings, the autority found the household exemption of Art 2 para 2 lit c GDPR to be inapplicable in the case at hand.
The exception would only apply – and consequently, result in the inapplicability of the GDPR – in cases of data processing carried out in relation to an activity that is exclusively personal or household in nature. With reference to the ECJ judgement in C-25/2017, it was further stressed that the terms “personal” and “household” refer to the activity of the person processing the personal data and not to the person whose data are being processed.
The authority held that the husband as data controller had failed to comply with his obligations under Art 15 para 1 and 2 GDPR and ordered him to provide his wife with the respective information within four weeks.
Regarding her request to receive copies of the emails, email contact list and audio recordings, the complaint, however, was dismissed.
Although the authority stated that Art 15 para 3 GDPR provides for a right to obtain a copy in addition to the right to receive information on the content of the processed data pursuant to para 1, the provision (unlike Art 20 para 1 GDPR) does not entitle the data subject to receive entire documents (or – as in the present case – email correspondence, a list of email contacts and sound recordings) even if they contain his/her personal data.
In this context, the authority (indirectly) relied on the ECJ decision in C-141/12 and C-372/12 issued in 2014, where the court dealt with the interpretation of the right of access as laid down in Art 12(a) of Directive 95/46, and particularly the question, whether a data subject can derive a right to obtain a copy of the documents or the original files in which his/her data appear from that provision. In this preliminary ruling the ECJ had clearly stated that such a right does not exist insofar as the objective pursued by the right of access may be fully satisfied by another form of communication.
3. CONCLUSION
Many questions regarding the scope of the right to copy pursuant to Art 15 para 3 GDPR are still unresolved. However, it can be assumed that the Austrian data protection authority will continue to refer to the respective established case law on Art 12(a) of Directive 95/46. Accordingly, the scope of the right is to be interpreted narrowly. The data controller is not obliged to hand over entire documents (and the like) which contain the data subject’s personal data in order to comply with his duties under Art 15 para 3 GDPR, even if the term “copy” might suggest such an understanding. He is only obliged to provide an extract of the data contained therein. In this sense, the right to obtain a copy is merely a separate special form of the right to access. This understanding also corresponds to the view expressed in doctrine that – in view of the previous case law on Art 12(a) of Directive 95/46 – a comprehensive surrender claim would otherwise have been explicitely formulated in Art 15 GDPR (see f.e. Dausend, Der AUskunftanspruch in der Unternehmenspraxis, ZD 2019, 106.)
Article provided by: Stephan Winklbauer (AHW Law, Austria)
Discover more about INPLP, the INPLP-Members and the GDPR-FINE database
Dr. Tobias Höllwarth (Managing Director INPLP)
