Referral C-676/25 (Viva credit, 22 Oct 2025)

1. Are Article 8 of the Charter of Fundamental Rights of the European Union, Article 12(1) and (5) and Article 15(3) of Regulation (EU) 2016/679, 1 read in conjunction with recitals 58 and 60 to 63 of that regulation and with the judgments of the Court of Justice in Cases C-487/21 2 and C-307/22, 3 to be interpreted as meaning that, in the context of a terminated legal relationship between a lender and a borrower under a loan agreement, the right of the data subject to obtain a copy of personal data undergoing processing in the form of storage (archiving) for the duration and the purposes of the application of anti-money laundering measures imposes on the controller an obligation also to provide, upon each request, a full copy of the loan agreement in relation to which consent to the processing of the data was given?

2. Is the right to data portability under Article 20(1) of the GDPR to be interpreted as also including the right of the data subject to receive a full paper copy of the loan agreements upon the conclusion of which he or she provided his or her personal data, in the case where the agreements have been terminated and the data collected/processed on the basis of those agreements are stored by the controller exclusively for the purposes and the duration of the application of anti-money laundering measures?

3. What is the relationship between, on the one hand, the principles of transparency, data minimisation and accuracy under Article 5(1)(a), (c) and (d) of the GDPR and the rights under Article 15(1) and (3) and Article 20(1) of the GDPR – namely the rights of access to and the portability of personal data undergoing processing in the form of storage (archiving) for the purposes and the duration of the application of anti-money laundering measures – and, on the other hand, the controller’s obligation to provide the data subject not only with a copy of the data but also with a full copy of the loan agreement, in the case where: (1) the loan agreement was concluded after the data subject had been profiled using machine learning algorithms; and (2) the controller proves that the data subject already has it?

4. If the obligation to provide a full copy of the loan agreement is not absolute (is not presumed), the data are processed only in the form of being stored (archived) for the purposes and the duration of the application of anti-money laundering measures and the data subject claims that, without a full copy of the agreement, he or she cannot understand the context and the effects of the processing, by reference to what objective criteria and under what conditions should the national court assess whether the controller is obliged to provide a full copy of the loan agreement?

5. Within the framework of the protection under Article 79 of the GDPR and Article 8 of the Charter, is an assessment by the controller that the loan agreement contains clauses which do not fall within the scope of the right under Article 15(1) and (3) [of the GDPR] and that the request is disproportionate and repetitive subject to judicial review, and by reference to what objective criteria/under what conditions should that review be carried out by the national court?