Received A Request For Access? This Is What Your Organisation Should Know (And Do)

Data is everywhere. Every day, organisations process personal data relating to customers, employees and partners. Nevertheless, it is not always clear to individuals what personal data an organisation processes, and for what purposes. Regulation (EU) 2016/679, better known as the General Data Protection Regulation (GDPR), gives individuals the right to access their personal data. For organisations, this means that transparency is not optional, but a legal obligation.

In this newsletter, we outline the key aspects of the right of access and explain how your organisation can respond to a request correctly and efficiently.

Why does the right of access exist?

As a company, you are responsible for clear communication about the way in which you process personal data.

The right of access allows data subjects to:

• check whether their personal data is being processed;
• gain insight into what personal data is being processed;
• understand what the purpose of the processing is, how long data is stored, who the recipients are and what rights they have.

Much of this information can be found in your organisation’s record of processing activities and the privacy notice.

Conditions: a request without barriers

A request for access does not require the data subject to provide any justification and is subject to very few formal requirements. In principle, the data subject only needs indicate which right they wish to exercise, address the request to the controller and, where necessary provide prove of their identity. As a controller, you are obliged to provide accessible communication channels that allow data subjects to easily exercise their rights.

Please note that while you must to provide user-friendly channels for exercising data protection rights, data subjects are not required to use those channels and may submit their request through a different contact point. However, where a request is sent to an arbitrary or clearly inappropriate address, this may affect your obligation to respond.

Preliminary checklist: what you need to check when receiving a request for access

An access request may seem straightforward at first glance. However, as an organisation, you cannot simply disclose personal data without first carrying out a number of important checks:

• is the identity of the data subject clear? Only request additional information where this is necessary and proportionate. Until the data subject’s identity has been verified, you access may be refused;
• has the request been made by the data subject themselves, or by an authorised third party? If submitted by a third party, such as a parent or guardian, verify that they are duly authorised to act on the data subject’s behalf;
• does the request actually concern personal data? If it relates to other information the right of access does not apply in principle;
• does the request concerns specific personal data, or all personal data relating to the data subject? Unless expressly stated otherwise, you can assume that the request covers all personal data relating to the data subject. However, the controller may ask the data subject to clarify or specify the scope of their request;
• does your organisation still retain the personal data requested? Personal data that has been erased can no longer be provided.

Only after these checks have been completed can access be granted. Ensure that your internal processes support these checks, as errors may lead to complaints and (financial) sanctions.

Scope: what is personal data?

The right of access applies to the data subject’s personal data. This includes not only common types of personal data, such as name, address and telephone number, but also more specific and sensitive information, such as medical results, purchase history, creditworthiness, activity logs and search history. The concept of ‘personal data’ must be interpreted broadly. Chat messages, emails and telephone recordings may also constitute personal data.

Pseudonymised data also falls within the scope of the right of access, provided that it can be linked to an identifiable individual. Anonymised data, on the other hand, falls outside the scope of the right of access, because it can no longer be linked to a specific person. Finally, the GDPR does not apply to personal data of deceased persons.

Granting access: this is how you do it

As a company, you are required to provide data subjects with access to their personal data. A mere summary is not enough: data subjects are entitled to obtain access all personal data being processed. This does not mean that you must always provide the original documents. Instead, access must be granted in a transparent and accessible manner.

In most cases, an overview of the personal data will be sufficient. However, where the source document is essential for the data subject to verify the lawfulness of the processing, access to that document may also be required. What matters is not the nature of the document itself, but whether the data subject can effectively exercise their right of access without it.

Moreover, there is no one-size-fits-all approach to granting access. When determining how access should be provided, the following factors should be taken into account:

• the volume of personal data involved;
• the complexity of the processing activities;
• the data subject’s abilityto understand the information provided;
• the specific needs of vulnerable groups (such as elderly people, children or individuals with visual or cognitive impairment).

Access may be provided in various ways, including:

• a copy of the personal data (the most common form);
• an oral explanation;
• on-site inspection, where requested by the data subject.

Where personal data is provided electronically, the data subject must be able to easily download and store it. For large volumes of personal data, a layered approach may be appropriate, provided that this is clearly communicated in advance. The first copy must be provided free of charge. A reasonable fee may be charged for any additional copies.

Please note that responding to an access request by merely inviting the data subject to inspect the personal data on site is not always sufficient. Data subjects who request a copy should receive a copy. A right to a copy implies a faithful and comprehensible reproduction of all personal data requested, in a form that the data subject can freely and permanently access. Obliging the person making the request to identify and copy the relevant documents themselves on site unlawfully shifts the burden from your organisation to the data subject.

Deadlines: legal time limits for responding to an access request

A request for access not only requires a correct response where content is concerned, but also a timely response. The table below gives an overview of the main deadlines.

Restrictions: when can you refuse a request for access?

Although data subjects have a right to access, exercising that right must not affect the rights and freedoms of others.

For example:

• third parties’ personal data;
• trade secrets;
• intellectual property rights;

Has your organisation received a request that also comprises this type of information? This does not automatically mean that the request must be refused. Often, it is possible to edit or anonymise sensitive information to allow the data subject to have access to the personal data they are entitled to access.

Your organisation can also refuse a request or charge a reasonable fee where requests from a data subject are manifestly unfounded or excessive. In the event of refusal, the data subject must be informed within one month of the following:

• the reason for the refusal;
• the right to file a complaint with the Data Protection Authority (DPA);
• the possibility of taking legal action.

A request is not automatically excessive because handling it requires a lot of time or effort. For example, the DPA recently rejected the argument of an employer that a request for access was excessive due to the considerable workload. According to the DPA, this exception should be interpreted narrowly. Only in exceptional cases, for example in the event of apparent abuse of rights or when the request clearly pursues a purpose other than transparency, may a refusal be justified. An unjustified refusal can result in complaints and sanctions. So make sure your organisation communicates in a transparent and careful way.

Conclusion

When your organisation receives a request for access, it is crucial to act in a timely and correct manner. Although the right of access may appear straightforward, applying it in practice is often more complex. Think, for example, of the balancing of interests, the protection of sensitive corporate information, and the correct application of exceptions. Therefore, a clear internal procedure is not an unnecessary luxury. It will prevent errors, complaints and sanctions for your organisation.