49
Adopted
makes it possible for the data subject to be made aware and verify the lawfulness of the processing.
Hence, there is no contradiction between the wording of the GDPR and the ruling by the CJEU
regarding this matter. The word summary in the ruling should not be misinterpreted as meaning that
the compilation would not encompass all data covered by the right of access, but is merely a way to
present all that data without giving access to the underlying documents which contain the personal
data. Since the compilation needs to contain a copy of the personal data, it should be stressed that it
cannot be made in a way that somehow alters or changes the content of the information.
Example 30: A data subject has been insured with an insurance company for many years. Several
insured incidents have occurred. In each case there has been some written correspondence through
e-mail between the data subject and the insurance company. As the data subject had to provide
information regarding the specific circumstances of each incident, the correspondence entails a lot of
personal information about the data subject (hobbies, flatmates, daily habits etc.). In some cases
disagreement arose about the insurance company’s obligation to compensate the data subject which
caused a vast amount of communication back and forth. All this correspondence is stored by the
insurance company. The data subject makes an access request. In this situation the controller does not
necessarily have to provide the e-mails in their original form by forwarding them to the data subject.
Instead the controller could choose to compile the e-mail correspondence containing the data
subject’s personal data in a file that is provided to the data subject.
153. Notwithstanding the form in which the controller provides the personal data, e.g. by providing the
actual documents containing the personal data or a compilation of the personal data, the information
shall comply with the transparency requirements laid down in Art. 12 GDPR. Making some kind of
compilation and/or extracting the data in a way that makes the information easy to comprehend could,
in some cases, be a way to comply with these requirements. In other cases the information is better
understood by providing a copy of the actual document containing the personal data. Hence which
form is most suitable must be decided on a case by case basis.
154. In this context, it is important to remember that there is a distinction between the right to obtain
access under Art. 15 GDPR and the right to receive a copy of administrative documents regulated under
national law, the latter being a right to receive a copy of the actual document. This does not mean
that the right of access under Art. 15 GDPR excludes the possibility to receive a copy of the
document/media on which the personal data appear.
155. In some cases, the personal data itself sets the requirements in what format the personal data should
be provided. For example, when the personal data constitutes handwritten information by the data
subject, the data subject may need to be provided with a photocopy of that handwritten information,
as the handwriting itself is personal data. That could especially be the case when the handwriting is
something that matters to the processing, e.g. scripture analysis. The same applies in general for audio
recordings because the voice of the data subject itself is personal data. In some cases, however, access
can be given by providing a transcription of the conversation, for example, if agreed upon between the
data subject and the controller.
156. It should be noted that the provisions on format requirements are different regarding the right of
access and the right of data portability. Whilst the right of data portability under Art. 20 GDPR requires
that the information is provided in a machine readable format, the right to information under Art. 15
does not. Hence, formats that are considered not to be appropriate when complying with a data
portability request, for example pdf-files, could still be suitable when complying with an access
request.