What happened
On a reference from the Administrative Court of Eastern Finland, the Court held that information about consultation operations carried out on a data subject's personal data, and about the dates and purposes of those operations, is information the person has the right to obtain under Article 15(1). It held that the same provision does not give a right to information about the identity of the controller's employees who carried out those operations under its authority and in accordance with its instructions, unless that information is essential to enable the person to exercise effectively the rights the Regulation confers, and provided the rights and freedoms of those employees are taken into account. It also held that Article 15 applies to a request made after the Regulation became applicable even where the processing concerned took place before that date, and that the controller being a bank in a regulated activity, or the requester being an employee as well as a customer, has in principle no effect on the scope of the right.
What changes at the desk
Access logs are within scope, so a request that asks who has been looking at a file has an answer and needs a split rather than a refusal. Disclose the dates and the purposes of the consultations, and withhold the names of the staff who made them unless the requester genuinely cannot exercise their rights without them. That is a redaction across a log, not a decision to leave the log out, and it is worth finding out now whether your systems can produce a consultation history at all.
Primary source
RulingEuropean Union22 Jun 2023
This entry is a draft. No practitioner has reviewed it, and it should be read against the document it names rather than relied on as advice.