Again and again there is uncertainty about how far the data protection right of data subjects actually goes and which documents in which form the responsible persons must provide. This was decided by the ECJ on 12.01.2023. The new guidelines of the European Data Protection Board are also intended to shed light on the darkness. Following the consultation procedure in spring 2022, the opinions contained therein were evaluated and adopted at the EDPB plenary session on 19 January 2023.
I. Judgment of the ECJ of 12.01.2023
The case before the ECJ concerned several data protection violations by Austrian Post: In 2019, a data subject had a right to information pursuant to Art. 15 GDPR. As a result, Swiss Post informed that personal data had been passed on to business customers, such as IT companies, for marketing purposes, among other things, without mentioning their names. However, the person concerned wanted to know exactly and therefore went to court. The Austrian Supreme Court then referred the question of whether the recipients must also be named to the ECJ. There it was decided that without specifically naming the data recipients, a data subject can only meaningfully assert his further rights, such as correction or deletion, if he knows who else has received his data.
II. EDPB guidelines
1. Scope of the right to information
The most important topics in the new guidelines remain the exact scope of the right of access, as well as the design of the information obligations of those responsible and the format of the request for information. Flat-rate information or even just a sending of the information text according to Art. 13 GDPR is not sufficient, rather the stored personal data as well as any data flows and their recipients must be precisely named. This includes not only a list of data categories, but also information about which data is stored in plain text. These must also be prepared in a comprehensible form for the person concerned; for example, information in English alone is not enough. In the case of image and voice recordings, copies must be sent to the person concerned, possibly with redactions, if otherwise the rights of other persons would be attacked.
2. Important in this context: Online shops and identity theft
In addition, it must not be unnecessarily difficult for complainants to gain access to the information: it is therefore insufficient if claims for information can only be asserted via a log-in or via a customer account. If an unauthorized person also gains access to an online account or customer account, this data is now also covered by the right to information, so that the customer can find out the identity of the perpetrator.
It is also exciting: As far as judicial decisions on the right to information are concerned, according to the supervisory authority, these always concern only the specific individual case and only have legal effect between the parties involved, so that these are generally not regarded as generally applicable standards.
For further information, please contact:
Diane Frank, Partner
SCHMID FRANK, Augsburg
e: ed.knarf-dimhcs@knarf.enaid
t: +49 (0)1578 90 333 60
#WLNadvocate #Germany #ITlaw #techlaw #technologylaw #legal #lawfirm #network #whistleblower #companylaw #dataprotection #dataprivacy #SupremeCourt