Skip to content

The Signal

Draft for review

The Board's adopted reading of the right of access

The adopted guidelines on Article 15: no reasons required, no mandatory form, a bare request means everything, and identity checks proportionate to the data at stake.

28 Mar 2023GuidelineEuropean UnionNot yet reviewed

What happened

The Board adopted the guidelines after public consultation on 28 Mar 2023, and published version 2.1 carrying minor corrections on 30 May 2024. The adopted text states that the data subject need give no reasons for a request and that it is not for the controller to analyse whether the request will help them. It states that there are no specific requirements on the format of a request, that a data subject is not obliged to use the channels a controller provides and may instead write to an official contact point, and that a controller need not act on a request sent to a completely random or apparently incorrect address. Unless a request explicitly says otherwise it is to be read as referring to all personal data concerning the requester, and the controller may ask them to specify it where a large quantity of data is processed. The controller has to search across all IT systems and non IT filing systems, on criteria that mirror how the information is structured. Where data is stored for only a very short period there must be measures ensuring that a request can be met without the data being erased while it is being dealt with. Applying Article 15(4) should not result in refusing the request altogether, only in leaving out or rendering illegible the parts that would adversely affect others. A request for further information to confirm identity must be proportionate to the type of data processed and the damage that could occur, so as to avoid excessive data collection.

What changes at the desk

Two habits fail against this text. The first is a form that is the only way in: keep the form, keep the portal, and answer the request that arrives by letter to the registered office as well. The second is an identity check sized to the controller's comfort rather than to the data at stake. Read a bare request as covering everything you hold, treat a narrowing as a question the requester is free to decline, and where they decline, answer as far as you can. And if any of the data in scope sits on a short retention clock, the hold goes on at intake, not when the search starts.

Primary source

GuidelineEuropean Union28 Mar 2023

This entry is a draft. No practitioner has reviewed it, and it should be read against the document it names rather than relied on as advice.