30
Adopted - version for public consultation
been the subject of several Art. 29 Working Party
38
documents
39
and has been interpreted by the CJEU,
including in the context of the right of access under Art. 12 of the Directive 95/46/CE.
93. The WP29 considered that the definition of personal data in the Directive 95/46/EC “reflects the
intention of the European lawmaker for a wide notion of ‘personal data’”
40
. Under the GDPR, the
definition still refers to “any information relating to an identified or identifiable natural person”. Aside
from basic personal data like name and address, telephone number etc., unlimited broad variety of
data may fall within this definition, including medical findings, history of purchases, creditworthiness
indicators, communication contents, etc. In light of the broad scope of the definition of personal data,
a restrictive assessment of that definition by the controller would lead to an erroneous classification
of personal data
41
and ultimately to a violation of the right of access.
94. In joint cases C-141/12 and C-372/12
42
the CJEU ruled that the right of access covered personal data
contained in minutes, namely the “name, date of birth, nationality, gender, ethnicity, religion and
language of the applicant” “and, “where relevant, the data in the legal analysis contained in the
minute”, but not the legal analysis itself
43
. The legal analysis was in this context not liable in itself to be
the subject of a check of its accuracy by the data subject nor of a rectification. Furthermore, providing
access to the legal analysis does not fulfil the purpose of guaranteeing privacy but access to
administrative documents.
95. In Nowak
44
, the CJEU made a broader analysis and found that written answers submitted by a
candidate at a professional examination and any comments of an examiner with respect to those
answers constitute personal data concerning the exam candidate. More precisely, such subjective
information are personal data “in the form of opinions and assessments, provided that it ‘relates’ to
the data subject”
45
as opposed to the examination questions, which are not considered personal
data
46
. Thus, a contextual assessment should shed light on the effect or result an information may have
on an individual and thus the scope of the right of access.
Example: An individual has a job interview with a company. In this context, the job applicant hands
over a CV and an application letter. During the interview, the HR officer takes notes on a computer to
document the interview. Afterwards, the job applicant, as data subject requests access to personal
data relating to them that the company, as controller, collected in the course of the recruitment
procedure.
38
The Art. 29 Working Party (Art. 29 WP) is the independent European working party that dealt with issues
relating to the protection of privacy and personal data until 25 May 2018 (entry into application of the GDPR),
the predecessor of the EDPB.
39
e.g. WP251 rev01 Guidelines on automated individual decision-making and profiling for the purposes of
regulation 2016/679 i.e., p.19; WP29 Guidelines on the right to data portability - endorsed by the EDPB,p. 9.
40
WP29 Opinion 4/2007 on the concept of personal data, p. 4.
41
as information not relating to an identified or identifiable natural person
42
Court of Justice of the European Union, Joined Cases C-141/12 and C-372/12, YS v Minister voor Immigratie,
Integratie en Asiel and Minister voor Immigratie, Integratie en Asiel v M and S, 17 July 2014.
43
CJEU, Joined Cases C-141/12 and C-372/12, YS and Others, paras. 38 and 48.
44
Court of Justice of the European Union, C-434/16, Peter Nowak v Data Protection Commissioner, 20 December
2017.
45
CJEU, C 434/16, Nowak, paras. 34- 35.
46
CJEU, C-434/16, Nowak, para. 58.