An Austrian company that conducts credit ratings of clients was requested to furnish a copy of the details collected on one of its clients. The company provided the final credit conclusion, but not the copy of the entire set of information.
The Court of Justice of the European Union held that the copy of the information, in its entirety, should be granted and not just the general conclusion. The right to receive the entirety of the information collected in a person by a private company is an absolute right, which is enshrined in the regulatory framework of privacy of citizens and is an automatic right. Despite the fact that the GDPR does not define the concept of “copy of the information”, it should be interpreted as the entire information collected on a person, and not just a summary of the information. The regulation is supposed to ease the process of the receipt of the information on the person which the information is collected on, and not make the process more difficult, hence a summary is not sufficient. Here, as the client received just a summary of the information, on a delicate matter such as credit score, without handing out the entire set of information that defined the credit score in a specific manner and without an option to appeal the scoring, the person is entitled to receive the entire information gathered on him.