Skip to content
News·noyb - European Center for Digital RightsEN
Export

Digital Omnibus reality check: 83.5% of access requests not properly answered

Data Subject Rights The most commonly exercised right under the GDPR is the right of access to one’s personal data that is being processed by companies.

Full text

Data Subject Rights The most commonly exercised right under the GDPR is the right of access to one’s personal data that is being processed by companies. After all, it’s often the prerequisite to know if there is inaccurate or unlawful personal data that needs to be corrected or deleted. However, a new analysis of noyb cases shows: Only 16.5% of all access requests noyb has sent to companies in the past 8 years received a satisfactory reply, while 53.7% of replies were incomplete – and almost 30% were not answered at all. In other words: while companies are lobbying Brussels to limit people’s right of access because of an alleged “abuse”, the real problem is non-compliance by these exact companies. No “abuse” by data subjects, but by companies. Following intense lobby pressure (especially by the German industry), the European Commission’s Digital Omnibus proposal argues that there’s a need to restrict data subject rights under the GDPR. Most notably, the proposed changes include a limit

How it connects

C/16/608667 / HA RK 26-54 The data subject was involved in disputes with a school organisation ("controller") Those disputes concerned a communication ban, their membership in a participation council, and their internship. The data subject submitted an access request under Article 15… C/16/608667 / HA RK 26-54 ·Rb. Midden-Nederland Sep 22, 2026 Right of Access Personal Data Controllers
W101 2326836-1 40 natural persons submitted access requests to a mobile communications provider (controller) via an attorney Some of these persons were (former) customers of the controller, others have never been in a contractual relationship with the controller. In the access requests, the data… BVwG - W101 2326836-1 ·Federal Administrative Court Oct 2, 2026 Personal Data Right of Access Right to Restriction
C/09/697386 / HA ZA 26-52 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1… Rb. Den Haag Sep 2, 2026 Right of Access Personal Data Data Portability
2984/2026 Bulgaria SAC: Controller must provide copies of loan documents under GDPR Art. 15 access The data subject requested that a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans (the controller) provide copies of… Oct 13, 2026 Controllers Right of Access Personal Data
€100,000 HDPA fines Teleperformance for failing to properly handle employee access request The DPA received a complaint from a former employee of the Service 800 Teleperformance Single Member S.A. (the controller), after the controller failed to comply with the data… Greece ·Art. 5, 12, 13 +3 Personal Data Right of Access Storage Limitation
200.361.079/01 Court of Appeal Den Haag: gambling operator must disclose transaction data under Art. 15 The data subject submitted an access request, in electronic format, of his gambling data to Risepoint Limited (the controller), the operator of online gambling services in the… Sep 29, 2026 Personal Data Data Portability Right of Access