Public authorities can charge to deal with subject access requests, CJEU rules

The Court of Justice of the European Union (CJEU) said, though, that the fees public authorities levy "must not exceed the cost of communicating such data" to the individuals.

EU data protection laws give individuals the right to obtain their personal data from organisations that store and process the information "without constraint at reasonable intervals and without excessive delay or expense". Organisations are obliged to communicate the data "in an intelligible form" upon request from the data subject.

An individual in the Netherlands had challenged a Dutch public body that had charged her facilitating access to her personal data it stored about her. Under Dutch law, local authorities in the Netherlands are generally obliged to provide such access free of charge. However, municipalities can charge for services they provide under a separate legal framework in place in the country. Those charges must "not exceed the estimated expenditure related thereto".

A court in the Netherlands asked the CJEU to rule whether it is legitimate for public authorities to charge to deal with subject access requests. It also asked for help in interpreting how to determine, if charges are permitted, whether fees imposed can be deemed to be 'excessive' under the Data Protection Directive.

The CJEU said that it was "clear" that the Data Protection Directive does not force EU member states to charge to facilitate the right to access personal data. However, it said that the "levying of such fees" is not prohibited under the framework either, "so long as they are not excessive".

The Court said that it was up to the individual EU member states that wish to allow charging for subject access requests to set an appropriate level for fees. The level fees are set at should enable there to be a balance between allowing individuals to exercise their privacy rights and acknowledging "the burden which the obligation to communicate such data represents for the controller", it said.

"The fees which may be levied ... may not be fixed at a level likely to constitute an obstacle to the exercise of the right of access guaranteed by that provision," the CJEU said in its ruling. "Where a national public authority levies a fee on an individual exercising the right to access personal data relating to him, the level of that fee should not exceed the cost of communicating such data. That upper limit does not prevent the Member States from fixing such fees at a lower level in order to ensure that all individuals retain an effective right to access such data."