Some Useful Clarifications On Right Of Access Under GDPR

• Published date: 16 June 2023
• Subject Matter: Privacy, Data Protection
• Law Firm: ELVINGER HOSS PRUSSEN, société anonyme
• Author: Ms EmmanuèLe De Dampierre

What happened?

One might think that the GDPR¹, in force for five years, would have revealed all its secrets by now, but there are still a number of points raised in practice that need(ed) to be clarified.

The year 2023 has already seen a number of clarifications with respect to the right of access under the GDPR:

• Clarification by the Court of Justice of the European Union (the "CJEU") of the notion of "copy" to be provided to the data subject

How far to go in responding to an access request? This is a recurring question in practice when controllers prepare their answer to an access request made under Article 15 of the GDPR. Contrary to the Directive 95/46/EC (GDPR's predecessor), Article 15(3) of the GDPR provides that "the controller shall provide a copy of the personal data undergoing processing". It was not clear whether it was enough for the controller to produce a full summary of those data in an intelligible form (as judged by the CJEU² under the Directive 95/46/EC) without producing a copy of the underlying document(s) containing the concerned data.

On 4 May 2023, the CJEU provided the long-awaited confirmation³: "the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by that regulation, bearing in mind that account must be taken, in that regard, of the rights and freedoms of others."

Therefore, the underlying document containing the concerned data does not necessarily have to be provided and if the decision is made to produce the entire document, it may be necessary to anonymise the parts involving third parties.

• EDPB's final version of Guidelines 01/2022 on data subject rights - Right of access

One year after the end of the public consultation, the European Data Protection Board (the "EDPB") adopted on 28 March 2023 the final version of its Guidelines 01/2022 regarding the right of access (the "Guidelines").

These Guidelines are an essential tool for controllers and data subjects to better understand the aim and the scope of the right of access, the methods of reply and the existing limits of a right that is more and more used by data subjects. Further to the public consultation, the Guidelines were updated...