Importance of distinguishing the right to access information about personal data from the general right of information disclosure

The case was initiated on the applicant’s request to declare the refusal of the national Orphan’s and Custody Court to allow the applicant to inspect the video recording of her and to provide it to her as unlawful, as well as for the court to impose an obligation to the national Orphan's and Custody Court to provide and then destroy the video recording in question. With the judgment of the national Administrative District Court the decisions of the national Orphan's and Custody Court were declared unlawful, however the application was rejected in the remaining part.

Administrative District Court dismissed the applicant’s claim to provide and then destroy the video recording of her. The facts were that the applicant of this case was not a party of the administrative proceedings where the video recording was submitted in and the video recording was submitted by the applicant’s granddaughter’s father. In her appeals the applicant stressed the inadequate processing of her data by the national Orphan’s and Custody Court.

The Senate in its Decision referred to the General Data Protection Regulation (hereinafter – GDPR) and the case law of the Court of Justice of the European Union (hereinafter – CJEU), concluding that the applicant had applied to the court to protect her data and not to obtain information within the meaning of the Law on Freedom of Information. The Senate also referred to its previous case law that provided that the right to obtain information on personal data held by an institution is a specific right that should not be linked to the general right of disclosure of information. The right of access to data protects an individual interest of a person, unlike the national Law on Freedom of Information, which ensures the possibility for members of the public to exercise their right to participate in public administration, thereby protecting the common interests of society. Both of the above-mentioned regulations have their own purpose for the achievement of which the right to obtain information is granted.

In relation to the scope of the right to access personal data, on 18 January 2022  the European Data Protection Board adopted detailed Guidelines on data subject rights - Right of access. The interpretation of the GDPR in the guidelines is based on the CJEU case law and it inter alia provides that the right of access is designed to enable natural persons to have control over personal data relating to them and it states that the right of access includes three different components: firstly, confirmation as to whether data about the person is processed or not; secondly, access to this personal data and, thirdly, access to information about the processing, such as purpose, categories of data and recipients, duration of the processing, data subjects’ rights and appropriate safeguards in case of third country transfers.

Although abovementioned Guidelines are not legally binding, they should be used when applying the provisions of the GDPR, including situations when it is crucial to distinguish a person’s right of access to his or her personal data from the general right to information disclosure. Therefore, it is expected that considerations provided in both – the Decision and Guidelines, will play an important role in the further development of personal data processing practices and protection of persons privacy.