What happened
The authority expressed serious criticism of DSB for handling an access request contrary to Article 15(3) and Article 12(2) and (3). The first answer listed the categories of personal data held and did not hand over their content; the content followed only after the authority asked the company for a statement, more than a month after the request. The request had asked for access to everything registered about the person. The company did not consider the camera recordings it held, because the request had not said so expressly, and the recordings were deleted on the thirty day cycle. The authority impressed on the company that a data subject cannot be required to ask expressly for data held in camera surveillance, and said that where a controller is in doubt about the scope of a request, or holds a large quantity of data, it may ask the requester for further detail such as a time, a place and a photograph, but that if the requester will not give it the controller must still answer as far as it can. It found no ground for criticism over data collected through cookies, the company having shown that it could not identify the person from them without further information and having said so.
What changes at the desk
Read a request for everything as a request for everything, and put a hold on anything with a short retention clock before you start collecting rather than after: footage on a thirty day cycle is gone before an unhurried answer is drafted. Asking for a time, a place or a photograph is a legitimate narrowing question and it is not a condition of answering. And an answer that lists what you hold without handing it over is not an answer under Article 15(3), however complete the list is.
Primary source
DecisionDenmark18 Nov 2019
This entry is a draft. No practitioner has reviewed it, and it should be read against the document it names rather than relied on as advice.