BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
Our reference: LDA-1085.3-2121/24-I
IMI Art. 56: 637741
IMI draft decision: 726255
Controller:
On the basis of the draft decision of the Information and Data Protection Comissioner (idpc; Malta SA)
No. 726255, the Data Protection Authority of Bavaria for the Private Sector (BayLDA) pursuant to Article
60(8) of the GDPR issues the following
Final Decision:
The complaint is rejected.
Justification:
The complaint was received by the BayLDA on 26.02.2024 and was forwarded via IMI to the Malta SA as
the lead data protection supervisory authority for the controller.
On 23.01.2025 the Malta SA submitted the draft decision no. 726255 to the concerned supervisory au-
thorities with the following contents:
IMI Article 56 identification of LSA and CSA entry 637741
IMI Case Register entry 713368
National file number LDA-1085.3-2121/24-I
Controller
Date of receipt of complaint 15.05.2024
With regard to the abovementioned case and pursuant to Article 60(3) of the General Data Protection
Regulation (GDPR), Data Protection Comissioner (idpc; hereafter: Malta SA) has issued the following
draft decision:
COMPLAINT
1. On the 26th February 2024, Mr (the “complainant”) lodged a complaint with the Bayer-
isches Landesamt für Datenschutzaufsicht (the “Bavarian DPA”) pursuant to article 77(1) of the
General Data Protection Regulation1 (the “Regulation”), alleging that
(the “controller”) failed to provide the information “in a valid, common MS-Office format”
following the exercise of his right of access in terms of article 15 of the Regulation.
2. On the 15th May 2024, the Bavarian DPA, as the concerned supervisory authority, informed the
Information and Data Protection Commissioner (the “Commissioner”) about the complaint pur-
suant to article 56(3) of the Regulation. The Commissioner decided to handle the case in ac-
cordance with the consistency and cooperation procedure provided in article 60 of the Regula-
tion after it was established that the main establishment of the controller is in Malta.
Information submitted by the complainant
3. The complainant held that he exercised his right of access in accordance with article 15 of the
Regulation on the 31st October 2023. The complainant requested the controller to provide the
following information:
4. On the 28th November 2023, the controller replied by providing a link to the data in PDF format.
However, the complainant was not satisfied with the format in which the data was provided.
Subsequently, through emails dated the 12th January 2024, the 22nd January 2024, the 6th Feb-
ruary 2024 and the 21st February 2024, the complainant reiterated his request for the infor-
mation to be provided in either Excel or Word format.
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 965/46/EC.
INVESTIGATION
5. Pursuant to the internal investigative procedure of this Office, the Commissioner, in its capacity
as the lead supervisory authority, provided the controller with the opportunity to provide any
information which it deemed relevant and necessary to defend itself against the allegation raised
by the complainant. On the 10th June 2024, the controller provided the following salient argu-
ments for the Commissioner to consider during the legal analysis of this case:
a. that the controller always utilises the PDF format when responding to the subject access
requests of its customers;
b. that article 20(1) of the Regulation stipulates the need for the data to provided in a
structured, commonly used, and machine-readable format, and therefore, the docu-
ments in PDF format meet this requirement;
c. that it is important to emphasise that the structure of the PDF document reflects the
format of the extracted data; in other words, it accurately replicates the format in which
data was originally saved;
d. that the PDF format offers significant compatibility advantages, as it can be opened on
nearly any device or operating system without requiring specialised software or appli-
cations, and this ensures consistency in presentation and ease of access;
e. that, additionally, PDFs typically occupy less storage space, and the content is more
challenging to alter, providing further benefits in terms of document integrity and se-
curity; and
f. that every machine-generated PDF document fulfils the condition of machine readabil-
ity as OCR recognition is also possible in this document.
LEGAL ANALYSIS AND DECISION
6. The complainant exercised his right of access pursuant to article 15 of the Regulation and re-
quested the controller to provide a copy of the information processed in relation to him. This
right enables the data subject to be aware of, and verify, the lawfulness of the processing con-
cerning him 2. The European Data Protection Board (the “EDPB”) in its ‘Guidelines 01/2022 on
2
Recital 63 of the Regulation.
data subject rights – Right of Access’3 emphasises that pursuant to the principle of accounta-
bility as set forth in article 5(2) of the Regulation, “the controller should always be able to
demonstrate, that the way to handle the request aims to give the broadest effect to the right of
access and that is in line with its obligation to facilitate the exercise of data subjects rights (Art.
12(2) GDPR)”4.
7. Article 12(3) of the Regulation states that “[w]here the data subject makes the request by elec-
tronic form means, the information shall be provided by electronic means where possible, unless
otherwise requested by the data subject”. This requirement is further complemented by means of
article 15(3) of the Regulation, which provides that “[w]here the data subject makes the request by
electronic means, and unless otherwise requested by the data subject, the information shall be
provided in a commonly used electronic form” [emphasis has been added].
8. In the present case, the Commissioner established that the controller made his request by elec-
tronic means, and therefore, the controller was legally obliged to provide the information in a
commonly used electronic form pursuant to the requirement set forth in article 15(3) of the
Regulation. The Regulation does not define what is a commonly used electronic form and this
may include several conceivable formats5. In the absence of a definition, the Commissioner pro-
ceeded to assess the guidance issued by the EDPB concerning the format of the information
that must be provided by the controller in reply to a subject access request:
“What could be considered as a commonly used electronic form should be based
on an objective assessment and not on what format the controller uses in its daily
operations. In order to determine what format is to be considered as a commonly
used format in the situation at hand, the controller will have to assess if there are
specific formats generally used in the controller’s area of operation or in the given
context. When there are no such formats generally used, open formats set in an
international standard, such as ISO, should, in general, be considered as commonly
used electronic formats. However, the EDPB does not exclude the possibility that
other formats may also be considered to be commonly used within the meaning
of Article 15(3). When assessing if a format is a commonly used electronic format,
the EDPB considers that it is of importance how easily the individual can access
information provided in the current format. In this regard it should be noted what
information the controller has provided to the data subject about how to access a
3
Version 2.1, adopted on the 28th March 2023.
4
Page 17 of Guidelines 01/2022.
5
Paragraph 148 of Guidelines 01/2022.
file which has been provided in a specific format, such as what programs or soft-
ware that could be used, to make the format more accessible to the data subject.”6.
9. The controller supplied the information to the complainant in PDF format. However, the com-
plainant requested that the information be provided in either Word or Excel format. The Com-
missioner noted that the EDPB considers PDF files to be an acceptable format for compliance
with the right of access as outlined in Article 15 of the Regulation:
“It should be noted that the provisions on format requirements are differ-
ent regarding the right of access and the right of data portability. Whilst
the right of data portability under Art. 20 GDPR requires that the infor-
mation is provided in a machine-readable format, the right to information
under Art. 15 does not. Hence, formats that are considered not to be ap-
propriate when complying with a data portability request, for example pdf-
files, could still be suitable when complying with an access request”7 [em-
phasis has been added].
10. This led the Commissioner to conclude that article 15(3) of the Regulation imposes an obligation
on the controller to provide the information in a commonly used electronic format, and there-
fore, in such case, the Commissioner considers that the PDF format is a well-established form,
and for the purpose of article 15(3) of the Regulation, this format is considered to be commonly
used and acceptable.
After assessing the format and content of the information provided by the controller, the Com-
missioner is hereby deciding that the provision of information by means of an electronic docu-
ment in PDF format is indeed compliant with the requirement set forth in article 15(3) of the
Regulation, and therefore, the complaint is being dismissed in its entirety.
As the concerned supervisory authorities (including BayLDA) did not object to this draft decision, the
BayLDA hereby adopts this draft decision as final decision in accordance with Article 60(8) of the GDPR.
Ansbach, 13.02.2025
6
Paragraph 149 of Guidelines 01/2022.
7
Paragraph 156 of Guidelines 01/2022.
Information on legal remedies
With reference to Art. 77 and 78 GDPR, we would like to point out that an appeal against this decision
can be lodged with the
Bayerisches Verwaltungsgerich in 91522 Ansbach,
Promenade 24 - 28, 91522 Ansbach
Information on the legal remedy
Appeals may be lodged in writing, for the record or electronically in a form authorised for the written
form. The lodging of an appeal by simple e-mail is not permitted and has no legal effect!
From 1 January 2022, the group of persons named in Section 55d VwGO (in particular lawyers) must
generally submit appeals electronically.
By virtue of federal law, a procedural fee is due in legal proceedings before the administrative courts as
a result of the filing of an action.