The Signal
What changed, and what it changes at the desk.
A record of the rulings, guidelines and decisions that move how an access request is answered. Each entry says what happened, links the document it was written from, and says in one paragraph what a practitioner does differently once it exists.
How this record works
Every entry links the published document it was written from, the judgment or the decision itself and never a report about it. An entry about a named organisation says only what that published document says: there is no speculation here about a fine, a company or a person, and no individual data subject is named even where a decision names one. This is a record of what was decided, not news and not commentary.
2 Apr 2025DecisionFinland
A form for every register, and an identity document, were both too much
A controller may offer a request form and may not require one, and it may not ask for more identifying data than it can check the requester against.
Not yet reviewed
Read the entry26 Oct 2023RulingEuropean Union
The first copy is free, whatever the requester wants it for
A controller must provide a first copy free of charge even where the reason for the request is not one of the reasons recital 63 gives.
Not yet reviewed
Read the entry29 Jun 2023DecisionSweden
A copy is only as complete as the systems that were searched
A reprimand and an order where the extract missed a mailbox nobody searched, a case system searched in the wrong case, and travel history searched on the wrong identifiers.
Not yet reviewed
Read the entry22 Jun 2023RulingEuropean Union
Consultation logs are disclosable, the names inside them usually are not
Access covers information about consultation operations on the data, but not the identity of the employees who carried them out unless that is essential to the requester's rights.
Not yet reviewed
Read the entry4 May 2023RulingEuropean Union
A copy means the data faithfully, and sometimes the document around it
A summary of categories is not a copy, and extracts or whole documents must be given where they are essential for the data to be intelligible.
Not yet reviewed
Read the entry28 Mar 2023GuidelineEuropean Union
The Board's adopted reading of the right of access
The adopted guidelines on Article 15: no reasons required, no mandatory form, a bare request means everything, and identity checks proportionate to the data at stake.
Not yet reviewed
Read the entry29 Nov 2022DecisionDenmark
A copy withheld in full because it concerned other people too
Serious criticism and an order: an exemption from the right of access is assessed item by item, so the parts it does not reach are still disclosed.
Not yet reviewed
Read the entry16 Feb 2022DecisionDenmark
An identity number collected out of habit, and an answer five months late
Serious criticism where a national identity number was taken with no purpose and no basis, and the access request that followed was answered late and incompletely.
Not yet reviewed
Read the entry31 Mar 2021DecisionSweden
The month runs from the request, not from the right inbox
A reprimand where a request sent to an address other than the designated one fell outside the internal routine and was answered more than five months later.
Not yet reviewed
Read the entry18 Nov 2019DecisionDenmark
A request for everything covers the camera footage too
Serious criticism where the answer listed the categories held without handing over their content, and footage was deleted because the request had not named it.
Not yet reviewed
Read the entry