On 22 June 2023, the EU Court of Justice (ECJ) issued its judgment in case C-579/21 (J.M., Apulaistietosuojavaltuutettu, Pankki S) on the interpretation of Article 15 of the GDPR, which grants data subjects the right to access their personal data and information about the processing of such data from the controller. Notably, the ECJ held that information relating to consultation operations carried out on a data subject's personal data and concerning the dates and purposes of those operations constitutes information which that person has the right to obtain from the controller. On the other hand, according to the ECJ, Article 15 of the GDPR does not lay down such a right in respect of information relating to the identity of the employees of the controller carrying out those operations under its authority and in accordance with its instructions, unless that information is essential in order to enable the person concerned to effectively exercise the rights conferred on him or her by that regulation, and provided that the rights and freedoms of those employees are taken into account.
Originally published July 2023
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
