Sufficient, Transparent, and Accessible? EDPB Adopts Right of Access Guidelines

Editor’s Note: The European Data Protection Board (EDPB) is an independent European body, which contributes to the consistent application of data protection rules throughout the European Union, and promotes cooperation between the EU’s data protection authorities. The EDPB is established by the General Data Protection Regulation (GDPR) and is based in Brussels.

Shared with permission,* the announcement and a copy of the recently adopted Guidelines on the Right of Access are provided for your consideration as cyber, information governance, and legal discovery professionals in the eDiscovery ecosystem dealing with data subject access requests (DSARs).

One salient example of the precision provided in the new EDPB guidance is noted in the following scenario.

Example: An individual was dismissed by their employer. One week later, the individual decides to collect evidence to file an unfair dismissal lawsuit against their former employer. With that in mind, they write to the former employer requesting access to all personal data relating to them, as data subject, that the former employer, as controller, processes.

The controller shall not assess the intention of the data subject, and the data subject does not need to provide the controller with the reason for their request. Therefore, if the request fulfills all other requirements, the controller needs to comply with the request, unless the request proves to be manifestly unfounded or excessive in accordance with art. 12 (5) of the GDPR, which the controller is required to demonstrate.

Variation: The data subject exercises the right of access with regard to the personal data relating to them during the course of the lawsuit. However, the national law of the Member State, which governs the employment relation between the controller and the data subject, contains certain provisions that limit the scope of information to be provided to or exchanged between parties to ongoing or prospective legal proceedings, which are applicable to the unfair dismissal lawsuit that the data subject filed. In this context and provided that, these national provisions comply with the requirements posed by Art. 23 GDPR, the data subject is not entitled to receive more information from the controller than is prescribed by the national law provisions of the Member State governing the information exchange between parties to legal disputes.

As seen in the precision guidance of this one example scenario, the Guidelines should be strongly be considered by organizations dealing with personal data.

Announcement*

EDPB Adopts Guidelines on Right of Access

During its January plenary session, the EDPB adopted Guidelines on the Right of Access. The Guidelines aim to analyze the various aspects of the right of access and to provide more precise guidance on how the right of access has to be implemented in different situations. Among others, the Guidelines provide clarifications on the scope of the right of access, the information the controller has to provide to the data subject, the format of the access request, the main modalities for providing access, and the notion of manifestly unfounded or excessive requests.

According to EDPB Chair, Andrea Jelinek:

“The right of access enables individuals to get knowledge on how and why their personal data are processed. The Guidelines provide examples to support controllers to answer access requests in a GDPR compliant manner.”

The Guidelines will be subject to public consultation for a period of 6 weeks.

Read the original announcement.

Guidelines*

Guidelines 01/2022 on Data Subject Rights – Right of Access

Executive Summary Extract 

The right of access of data subjects is enshrined in Arti. 8 of the EU Charter of Fundamental Rights. It has been a part of the European data protection legal framework since its beginning and is now further developed by more specified and precise rules in Art. 15 GDPR.

Aim and overall structure of the right of access

The overall aim of the right of access is to provide individuals with sufficient, transparent, and easily accessible information about the processing of their personal data so that they can be aware of and verify the lawfulness of the processing and the accuracy of the processed data. This will make it easier – but is not a condition – for the individual to exercise other rights such as the right to erasure or rectification.

The right of access according to data protection law is to be distinguished from similar rights with other objectives, for example the right of access to public documents which aims at guaranteeing transparency in public authorities’ decision-making and good administrative practice.

However, the data subject does not have to give reasons for the access request and it is not up to the controller to analyze whether the request will actually help the data subject to verify the lawfulness of the relevant processing or exercise other rights. The controller will have to deal with the request unless it is clear that the request is made under other rules than data protection rules.

The right of access includes three different components:

• Confirmation as to whether data about the person is processed or not,
• Access to this personal data and
• Access to information about the processing, such as purpose, categories of data and recipients, duration of the processing, data subjects’ rights and appropriate safeguards in case of third-country transfers.

Read the original guideline document.

Read the Complete Report: Guidelines On Data Subject Rights – Right of Access (PDF) – Mouseover to Scroll

*Shared with permission.

Additional Reading

• A Safe Space for Online Users? The European Union’s Digital Services Act
• The Digital Services Act: Transformational Digital Regulation from the European Commission

Source: ComplexDiscovery