PL EN
Book a meeting
Chapter 2Data Subject’s Rights
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 2.3
  1. 2.1Processing Data Subject’s Rights and Requests (Article 12 of the GDPR)
  2. 2.2Right to Be Informed and Privacy Information Obligation (Articles 13 and 14 GDPR)
  3. 2.3Right of Access to Data and to a Copy of Data (Article 15 GDPR)
  4. 2.4Right to Rectification of Data (Article 16 GDPR)
  5. 2.5The Right to Erasure (Right to Be Forgotten) (Article 17 GDPR)
  6. 2.6Right to Restriction of Processing (Article 18 GDPR)
  7. 2.7Obligation to Notify about Rectifying, Erasing, or Restricting of Processing of Data (Article 19 GDPR)
  8. 2.8Right to Data Portability, i.e. How to Transfer Data from One Controller to Another (Article 20 GDPR)
  9. 2.9The Right to Object (Article 21 GDPR)
  10. 2.10Profiling and Automated Decision-Making (Article 22 GDPR)

Right of Access to Data and to a Copy of Data (Article 15 GDPR)

Aleksander P. Czarnowski, Katarzyna Kunda, Maciej Gawronski, Michał Kibil, Michał Sztaberek & Paweł Punda

#3.1 Preliminary Remarks

Under Article 15 GDPR, a controller has an obligation to inform a data subject whether their personal data are processed, grant access to the personal data, and provide a large amount of information corresponding to the notification obligation when collecting data, and also release a copy of the data.

All of this has to be performed promptly and within no more than one month, or at least, within this time limit, a response must be given as to whether the individual’s data are processed. The time limit for a full response may be extended by two months, and the reason for the extension must be given.

In functional terms, the right of access to data comprises the following elements:

  1. 1)confirmation that the individual’s data are or are not processed,
  2. 2)providing a set of information corresponding to the PIO,
  3. 3)granting access to the data,
  4. 4)releasing a copy of the data.

#3.2 Time Limits

Confirmation that the individual’s data are or are not processed or refusal to act to execute the right of access to data must be given within one month of receipt of a request. Access must be granted and a copy of data released also within one month, but where necessary the time limit can be extended by a further two months. Notice of the extension must be given before the first time limit expires, with reasons for the postponement (e.g., the complex nature of the request, a queue to review files in an archive).

#3.3 Types of Information

Where data are processed, an individual has to be provided with a set of the information that has to be provided when collecting data and that means:

  1. a)the purposes of the processing;
  2. b)the data categories;
  3. c)information about the recipients or categories of recipients;
  4. d)the envisaged period for which the data will be stored or the criteria used to determine that period;
  5. e)information about the right to have data erased or rectified, to have the processing restricted, or object to the processing;
  6. f)information about the right to lodge a complaint with a supervisory authority;
  7. g)available information about data sources;
  8. h)information about automated decision-making and profiling;
  9. i)information about transfer of data to a third country, the safeguards in place in this regard, and of recipients in third countries.

#3.4 Access

Access must be granted to data. This access can be provided by making files or a computer terminal available in an archive. Recital 63 GDPR states clearly that this can be done using ‘remote access to a secure system’, i.e. a kind of electronic self-service option. Solutions of this type are being opted for by companies that have tens of thousands of customers and that do not have the resources to manually operate a data access procedure, not to mention act within the ‘statutory’ time limits in such cases.

There is no reason not to release a copy of the data in execution of the right of access. The only practical problem is that the right of access sensu stricto is free of charge, while a fee may be charged for copies of data to cover the cost of the service (except the first).

#3.5 Copy of Data

The first copy of data is free of charge. A fee may be charged for further copies which is ‘a reasonable fee based on administrative costs’. The more detailed the calculation and reasons given for the fee, the easier it will be to submit supporting arguments to supervisory authorities and consumer protection authorities. Charging a fee for subsequent copies of data should reduce the number of excessive requests.

#3.6 Request for More Specific Information

Under Recital 63 GDPR, a controller can request that the individual specify the activities to which the request relates. We analyse its implications a few paragraphs above when discussing excessive requests.

#3.7 Refusal

Action to execute an individual’s right of access or to copies of data can be refused where the request is excessive, for example where it requires action at unreasonable intervals (too often, to paraphrase Recital 63 GDPR). Release of copies of data should be refused or copies of data limited in cases where the release of certain data could result in breach of rights of others, as discussed below.

#3.8 Rights of Others

The right to copies of data cannot have an adverse effect on the rights and freedoms of others. Release of copies of data must be refused therefore if they also include third-party data release of which would breach regulations; data concerning judicial, disciplinary, or criminal proceedings if release of the copies of data would disrupt those proceedings; information covered by exclusive rights – copyright, related rights, patents – if release of copies of data would breach these rights; information subject to professional privilege, trade secrets, or other legally protected secrets of a third party, if release of copies of these data would be a breach of those secrets.

Of course, the problem arises of how the controller is supposed to determine that such circumstances exist and how it is supposed to be aware of the problem. In such a case, the solutions developed in application of the E-Commerce Directive can be referred to, i.e. the notice and takedown procedure, which says that action must be taken when ‘credible information’ comes to light of a conflict of rights.

It should be noted that the GDPR uses the phrase ‘rights and freedoms of others’, and not ‘rights and freedoms of third parties’. Persons ‘other’ than the data subject might also be the controller. Therefore, GDPR recognises that certain rights of the controller also cannot justify rejection to accommodate the right to copies of data. In particular, a controller’s trade secret can sometimes justify rejecting a request of a data copy.

When discussing the conflict between the rights of an individual and the ‘rights and freedoms of others’, it is hard not to make comparisons and enter the territory of the Act on Electronic Services, the E-Commerce Directive, and the Digital Millennium Copyright Act. Formally, the GDPR concerns only personal data, but in practice, this term can be very diluted and at times also cover content or other information that falls outside of the typical understanding of features of an individual. This is particularly evident in the context of the right of transfer of data, which was ‘inserted’ into the GDPR even though it originates from the discussion generally concerning the right of transfer of any kind of data and not personal data.

GDPR provides a certain solution to such conflicting situations. According to Article 18 GDPR, data subject may request restricting of data processing. If a data controller rejects a data copy request based on ‘rights of others’ exception, a data controller may (and often should) offer instead to keep the requested data for a reasonable time allowing a data subject to initiate legal proceedings and make a court, the Police, or other authorised bodies to request such data from a controller as evidence.

#3.9 Authentication and Communication

An important element of the process – as in the case of all rights of individuals – is determining the identity of the person making the enquiry.

The GDPR prefers communication with the person making the request by electronic means, and this method seems to be more efficient. This does not mean however that execution of a right requested, for example, by letter can be refused. Controllers have to determine for themselves how to ensure that every communication channel is convenient and credible. It only has to be remembered that authentication of the person making the request cannot be performed orally.

A copy of data can be released in various ways: on paper, in electronic form in formats that can be read by most users (this cannot be limited to closed formats, even the most popular; the most widely used will probably be PDF format).

#3.10 Terms of Service and Procedures

Due to the number of variables, as well as formalities, it makes sense to adopt terms of service for execution of the right of access – or more broadly conditions for execution of data subjects rights in which a data subject’s rights, the procedure whereby they are executed, the authentication requirements, and issues relating to third-party rights are laid down. It makes sense as well to draw up internal procedures for processing requests for access and copies of data and other rights.

As a feedback mechanism it makes sense to reconcile the Record of Processing Activities with findings from the processing of data subject rights.

#3.11 Data Mapping, Data Mining, Ticketing Tools

Of course, the basis of execution of an individual’s rights is good data mapping in an organisation, and in most organisations it is also having IT tools that can be used to execute particular requests that automate a process, facilitate financial settlement of the process, and also – and perhaps above all – facilitate retrieval of data.

#3.12 Summary

Action to execute data subject rights might prove to be a major challenge for an organisation. This has to be well prepared for at the organisation at procedural, data mapping, technology, and legal levels. The right of access to data and copies of data will probably be the most commonly exercised right because it will be exercised at the same time as or before other rights requiring action on the part of the controller are exercised, and failure to observe an individual’s rights can lead to a higher penalty.

Interestingly, a proper serving of the right to access and copy of data may lead to increased knowledge of a data controller about persons whose data it processes. Most organisations of any size tend to develop ‘silos’, which are internal departments or business lines. Those silos do not talk to each other that leads to problems with managing corporate know-how. In result, each silo has a fragmented knowledge about a particular person whose data it processes. In result, a data controller may have a number of unrelated ‘client profiles’ concerning the same person.

A smart data controller might use GDPR as an opportunity to increase internal knowledge about their clients, linking a process of serving subject access requests with customer relationship management processes and data wholesale solutions.