Judgment of the Court of Justice First Chamber, 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C-487/21

• Date: 04 May 2023
• Year: 2023

5

Although that provision is worded broadly, it does not include the right to exercise, for a fixed period,

such a mandate. Article 15 of the Charter appears in Title II thereof, entitled ‘Freedoms’, whereas

specific provisions concerning the right to stand as a candidate at elections appear in a separate title,

namely Title V, entitled ‘Citizens’ rights’.

5

The case-law of the European Court of Human Rights

supports that interpretation.

6

In the fourth and last place, the Court finds that Article 47 of the Charter does not preclude the

national legislation concerned, provided that the person concerned has had an effective opportunity

to challenge the legality of the report that made the finding of a conflict of interest and the penalty

imposed on the basis of it, including its proportionality.

The right to an effective remedy includes, among other aspects, the possibility, for the person who

holds that right, of accessing a court or tribunal with the power to ensure respect for the rights

guaranteed to that person by EU law and, to that end, to consider all the issues of fact and of law that

are relevant for resolving the case before it. In the present case, that right presupposes that the

referring court is able to review the legality of the assessment report calling into question the

applicant in the main proceedings and, if necessary, annul that report and the penalties imposed on

the basis of it.

II. PROTECTION OF PERSONAL DATA

Judgment of the Court of Justice (First Chamber), 4 May 2023, Österreichische

Datenschutzbehörde and CRIF, C-487/21

Link to the full text of the judgment

Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Data

subject’s right of access to his or her data undergoing processing – Article 15(3) – Provision of a copy of

the data – Concept of ‘copy’ – Concept of ‘information’

CRIF is a business consulting agency that provides, at the request of its clients, information on the

creditworthiness of third parties. It was for that purpose that it processed the personal data of the

applicant in the main proceedings, an individual. The latter applied to CRIF, on the basis of the

General Data Protection Regulation,

7

for access to personal data concerning him. In addition, he

asked to be provided with a copy of the documents, namely emails and database extracts containing,

inter alia, his data, ‘in a standard technical format’.

In response to that request, CRIF sent the applicant in the main proceedings, in summary form, the

list of his personal data undergoing processing. Being of the view that CRIF should have sent him a

copy of all of the documents containing his data, such as emails and database extracts, the applicant

5

See Articles 39 and 40 of the Charter on the right to vote and to stand as a candidate at elections to the European Parliament and at

municipal elections respectively.

6

See ECtHR, 8 November 2016, Savisaar v. Estonia, CE:ECHR:2016:1108DEC000836516.

7

Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons

with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data

Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).