What happened
The Board adopted the guidelines after public consultation on 28 Mar 2023, and published version 2.1 carrying minor corrections on 30 May 2024. The adopted text states that the data subject need give no reasons for a request and that it is not for the controller to analyse whether the request will help them. It states that there are no specific requirements on the format of a request, that a data subject is not obliged to use the channels a controller provides and may instead write to an official contact point, and that a controller need not act on a request sent to a completely random or apparently incorrect address. Unless a request explicitly says otherwise it is to be read as referring to all personal data concerning the requester, and the controller may ask them to specify it where a large quantity of data is processed. The controller has to search across all IT systems and non IT filing systems, on criteria that mirror how the information is structured. Where data is stored for only a very short period there must be measures ensuring that a request can be met without the data being erased while it is being dealt with. Applying Article 15(4) should not result in refusing the request altogether, only in leaving out or rendering illegible the parts that would adversely affect others. A request for further information to confirm identity must be proportionate to the type of data processed and the damage that could occur, so as to avoid excessive data collection.
What changes at the desk
Two habits fail against this text. The first is a form that is the only way in: keep the form, keep the portal, and answer the request that arrives by letter to the registered office as well. The second is an identity check sized to the controller's comfort rather than to the data at stake. Read a bare request as covering everything you hold, treat a narrowing as a question the requester is free to decline, and where they decline, answer as far as you can. And if any of the data in scope sits on a short retention clock, the hold goes on at intake, not when the search starts.
Primary source
GuidelineEuropean Union28 Mar 2023
This entry is a draft. No practitioner has reviewed it, and it should be read against the document it names rather than relied on as advice.