Judgment of the Court of Justice First Chamber of 26 October 2023, FT Copies of medical records, C-307/22

• Date: 26 October 2023
• Year: 2023

2

I. PROTECTION OF PERSONAL DATA

Judgment of the Court of Justice (First Chamber) of 26 October 2023, FT (Copies of medical

records), C-307/22

Link to the full text of the judgment

Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 12,

15 and 23 – Data subject’s right of access to his or her data undergoing processing – Right to obtain a first

copy of those data free of charge – Processing of a patient’s data by his or her medical practitioner –

Medical records – Reasons for the request for access – Use of data for the purpose of triggering the

liability of the person providing treatment – Concept of ‘copy’

DW requested that FT, his dentist, provide him with a first copy of his medical records free of charge.

He made that request with a view to triggering FT’s liability for errors allegedly made by her in

providing him with dental care.

Relying on German law pursuant to which the patient may obtain a copy of his or her medical records

on condition that he or she reimburse the person providing treatment for the costs resulting

therefrom,

1

FT refused to provide DW with such a copy, following which DW brought an actio n. Both

the court of first instance and the court hearing the appeal upheld DW’s request to be provided with a

first copy of his medical records free of charge.

Hearing an appeal on a point of law (Revision) brought by FT, the Bundesgerichtshof (Federal Court of

Justice, Germany) has put questions to the Court of Justice concerning the interpretation of the

provisions of the GDPR which refer to the rules governing the exercise of the data subject’s right of

access to his or her data, as well as the restrictions of the scope of that right.

2

By its judgment, the Court concludes, first of all, that, where the data subject so requests, the

controller is obliged to provide him or her with a first copy of his or her personal data, free of charge,

for purposes other than becoming aware of the processing of those data and verifying the lawfulness

of that processing, which are explicitly referred to in the preamble to the GDPR. Next, it rules on the

parameters of the option for the Member States to restrict, in the name of the economic interests of

the controller, the right to obtain a copy of the data by requiring the data subject to pay fees incurred

by that controller in that regard. Lastly, it examines the need to provide the data subject, in certain

cases, with a full copy of the data in his or her medical records.

Findings of the Court

In the first place, as regards the question whether the controller is also under an obligation to provide

the data subject with a first copy of his or her data free of charge with a view to pursuing purposes

other than those explicitly referred to in the preamble to the GDPR, the Court recalls that the first

sentence of Article 15(3) of that regulation confers on the data subject the right to obtain a faithful

reproduction of his or her personal data, understood in a broad sense, that are subject to operations

that can be classified as ‘processing carried out by the controller’.

3

In addition, it follows from a

1

Second sentence of subparagraph 2 of Paragraph 630g of the Bürgerliches Gesetzbuch (German Civil Code).

2

More specifically, Article 12(5), Article 15(1) and (3), and Article 23(1)(i) of Regulation (EU) 2016/679 of the European Parliament and of the

Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of

such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2)

(‘the GDPR’).

3

Judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF (C-487/21, EU:C:2023:369, paragraph 28).