# Right of Access — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/right-of-access
> Sources are cited per item. Verify against the official texts before relying on them.

Data subject right to access their personal data

## Overview

## Legal Framework

The right of access is governed primarily by [Article 15 GDPR](/laws/gdpr/art-15), which grants data subjects a layered set of entitlements: confirmation of whether processing is occurring, access to the personal data itself, and a specified bundle of accompanying information including processing purposes, recipient categories, retention periods, and the existence of automated decision-making. Recital 63 frames the right as a verification mechanism:

> "a data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing"
> — [GDPR Recital 63](/laws/gdpr/rec-63)

Article 15(3) additionally requires controllers to provide a copy of the personal data undergoing processing, with Article 15(4) stipulating that this right must not adversely affect the rights and freedoms of others — including trade secrets and intellectual property. Article 32 GDPR touches peripherally on access insofar as technical and organisational measures must safeguard the ability to restore availability and access to personal data after incidents.

## Key Developments

The CJEU has confirmed that Article 15 introduced a broader right than its predecessor under Directive 95/46, specifically by granting an explicit right to obtain a copy rather than mere communication of data in intelligible form. In *Österreichische Datenschutzbehörde v CRIF*, the Court stated:

> "Article 15 of that regulation provides, in that regard, for a right to obtain a copy, unlike the second indent of Article 12(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995"
> — [CJEU, CRIF ¶33](/posts/51486#seg-33)

The EDPB's Guidelines 01/2022 clarify that the assessment must reflect the situation when the request was received and that even unlawfully processed data must be disclosed:

> "Even data that may be incorrect or unlawfully processed will have to be provided."
> — [EDPB Guidelines 01/2022 §9](/posts/38055#seg-9)

Enforcement actions confirm that denying access outright invites sanctions. The Irish DPA found Limerick City and County Council in violation of Article 15 for refusing access requests relating to traffic-management camera footage. The Italian DPA fined Experian Italia for incomplete Article 15 responses, demonstrating that partial or cursory compliance falls short.

The EDPB's one-stop-shop digest addresses the tension between access and third-party rights under Article 15(4), noting that the provision's wording may suggest the limitation applies only to copies under Article 15(1), though the broader text indicates a wider scope.

## Status of the Debate

The right of access is actively contested in court. The core entitlement — confirmation, access, and a copy — is settled. But the boundaries remain disputed, particularly around the scope of Article 15(4)'s limitation on third-party rights, what constitutes a "copy" in practice, and how controllers should handle requests involving large volumes or mixed personal data of multiple individuals. The CRIF ruling clarified that copies must faithfully reproduce the data but left open questions about format and redaction. No definitive court split is on record yet; a future CJEU referral clarifying the outer limits of Article 15(4) — particularly how trade secrets and third-party data should be redacted without rendering the response meaningless — would resolve the principal open question.

## Practical Guidance

- **Respond to the full scope of Article 15(1):** Provide confirmation of processing, access to the data, and all eight enumerated categories of information. Partial responses based on the data subject's perceived needs risk enforcement, as the Experian Italia case illustrates.

- **Provide a faithful copy under Article 15(3):** The copy must accurately reproduce the personal data undergoing processing. Do not withhold data simply because it was unlawfully collected or contains errors — the EDPB is explicit that such data must still be disclosed.

- **Apply Article 15(4) redactions narrowly:** Where third-party rights or trade secrets are implicated, redact only what is strictly necessary. The EDPB cautions that the limitation should not become a blanket refusal mechanism.

- **Assess at the moment of receipt:** Base your response on the data held when the request arrived. Data deleted under a retention policy before that point need not be provided, but data still in your systems — regardless of its accuracy or lawfulness — must be.

- **Document the access-response process:** Maintain internal logs showing what was provided, what was redacted, and the legal basis for each redaction. This creates an evidentiary record if a supervisory authority challenges the completeness of your response.

## Legislation (full text of key provisions)

### Right of access by the data subject

*Source: GDPR, gdpr-art-15-en, 2016-04-27 — https://overview.legal/posts/90406*

### Processing under the authority of the controller or processor

*Source: GDPR, gdpr-art-29-en, 2016-04-27 — https://overview.legal/posts/90592*

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

### Recital 63 — data subject right of access

*Source: GDPR, gdpr-rec-63-en, 2016-04-27 — https://overview.legal/posts/91641*

A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.

### Recital 164 — supervisory authority access and professional secrecy

*Source: GDPR, gdpr-rec-164-en, 2016-04-27 — https://overview.legal/posts/91843*

As regards the powers of the supervisory authorities to obtain from the controller or processor access to personal data and access to their premises, Member States may adopt by law, within the limits of this Regulation, specific rules in order to safeguard the professional or other equivalent secrecy obligations, in so far as necessary to reconcile the right to the protection of personal data with an obligation of professional secrecy. This is without prejudice to existing Member State obligations to adopt rules on professional secrecy where required by Union law.

### Recital 146 — Commission decision procedural rights and confidentiality

*Source: DSA, dsa-rec-146-en, 2022-10-19 — https://overview.legal/posts/95689*

The provider of the very large online platform or of the very large online search engine concerned and other persons subject to the exercise of the Commission’s powers whose interests may be affected by a decision should be given the opportunity of submitting their observations beforehand, and the decisions taken should be widely publicised. While ensuring the rights of defence of the parties concerned, in particular, the right of access to the file, it is essential that confidential information be protected. Furthermore, while respecting the confidentiality of the information, the Commission should ensure that any information relied on for the purpose of its decision is disclosed to an extent that allows the addressee of the decision to understand the facts and considerations that led up to the decision.

### Recital 110 — lawful domain registration data access

*Source: NIS2, nis2-rec-110-en, 2022-12-14 — https://overview.legal/posts/96748*

The availability and timely accessibility of domain name registration data to legitimate access seekers is essential for the prevention and combating of DNS abuse, and for the prevention and detection of and response to incidents. Legitimate access seekers are to be understood as any natural or legal person making a request pursuant to Union or national law. They can include authorities that are competent under this Directive and those that are competent under Union or national law for the prevention, investigation, detection or prosecution of criminal offences, and CERTs or CSIRTs. TLD name registries and entities providing domain name registration services should be required to enable lawful access to specific domain name registration data, which are necessary for the purposes of the access request, to legitimate access seekers in accordance with Union and national law. The request of legitimate access seekers should be accompanied by a statement of reasons permitting the assessment of the necessity of access to the data.

## Case law

### Council of State: Tax Authority adequately fulfilled GDPR access request on FSV

*Source: Council of State, 2026-08-05 — https://overview.legal/posts/187482 — original: https://gdprhub.eu/index.php?title=RVS_-_202307578/1/A3*

Facts — The personal data of an individual was stored in the Fraud Detection System (FSV), an application used by the Dutch Tax Authority between 2012 and 2020 to record potential indicators of tax fraud. The Minister of Finance was the controller. The data subject submitted an access request under Article 15 GDPR. In particular, she requested information about the personal data processed, the purposes of the processing, the recipients of the data, its source and retention period, and any automated decision-making concerning her. The controller provided an overview of the personal data stored in the FSV and answered the data subject’s questions. The data subject objected to the decision, claiming that the controller had not disclosed all information relating to her registration. The controller rejected the objection. It explained that the data subject had been selected for a manual review of her tax return under Project 1043, an anti-fraud initiative launched by the Dutch Tax, and was consequently registered in the FSV. It also stated that the data was accessible only to employees of the Tax Authority and had not been disclosed to other organisations. The District Court of Amsterdam dismissed the data subject’s appeal. It held that the proceedings concerned compliance with the GDPR access request and not the lawfulness of her inclusion in the FSV or any alleged resulting damage. The data subject appealed this judgment before the Council of State. Holding — The Council of State dismissed the appeal and upheld the judgment of the District Court. The Court held that there was no evidence that the controller had incorrectly applied Article 15 GDPR. The controller had provided an overview of all personal data concerning the data subject processed in the FSV, explained the purposes of the processing and clarified the circumstances of her registration under Project 1043. Although the data subject suspected that the controller held additional information, she did not provide concrete evidence supporting this claim. The Court also found no indication that she had been classified as a fraudster or that her personal data had been disclosed to other organisations. The Court further clarified that the lawfulness of the data subject’s registration in the FSV, the deletion of her data and any claim for compensation fell outside the scope of the access proceedings. Consequently, the Court confirmed the contested judgment and did not award litigation costs.

### Judgment of the Court (Eighth Chamber), 12 December 2013.#X.#Request for a preliminary ruling from the Gerechtshof te ’s-Hertogenbosch.#Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Conditions for exercising a right of access — Levying of excessive fees.#Case C‑486/12.

*Source: Court of Justice of the European Union, C-486/12, 2013-12-12 — https://overview.legal/posts/132372 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0486*

In Case C-486/12, the Court of Justice of the European Union interpreted Article 12(a) of Directive 95/46/EC in response to a preliminary ruling from the Gerechtshof te 's-Hertogenbosch concerning whether a Dutch municipality could levy a fee for providing a data subject with a certified transcript of personal data. The core issue was whether the directive's guarantee of access "without excessive delay or expense" permits controllers to charge fees, or whether the term "expense" should be read disjunctively from "delay," potentially allowing reasonable fees. The Court held that while Article 12(a) does not categorically prohibit fees for access to personal data, any fee charged must not be excessive, meaning it must not pose a deterrent to the exercise of the right of access, and that a fee is likely excessive if it exceeds the cost of reproducing and communicating the data.

### Munich Court: §11(8) RBStV validly restricts Art. 15 GDPR access for broadcasting

*Source: Administrative Court Munich, 2026-05-18 — https://overview.legal/posts/108991 — original: https://gdprhub.eu/index.php?title=VG_München_-_M_26a_K_25.5210*

Facts — The data subject had been liable to pay broadcasting contributions to the Controller, a German regional public broadcasting authority, since 2007. Following objections to several contribution assessment notices, the data subject submitted a request under Article 15 GDPR seeking a copy of all personal data processed about him by the Controller. The Controller responded by providing the categories of personal data and related information specified under § 11(8) of the German Broadcasting Contribution Treaty (RBStV), which governs data subject access requests relating to broadcasting contribution records, together with general privacy information. The data subject argued that the response was incomplete because it did not include copies of all documents containing his personal data, including correspondence with him and third parties. The Controller maintained that it had fully complied with its obligations under the RBStV. After the Controller declined to provide additional information, the data subject brought proceedings seeking disclosure of all personal data concerning him processed by the Controller. Holding — The Court held that § 11(8) of the German Broadcasting Contribution Treaty (RBStV) constituted a lawful restriction of the broader right of access under Article 15 GDPR pursuant to Article 23(1)(e) GDPR. It found that the national provision was a valid legislative measure, respected the essence of the fundamental right to data protection, and pursued an important public interest by ensuring the effective financing and administration of the public broadcasting system. The Court further held that the restriction was necessary and proportionate, noting that requiring the Controller to comply with the full scope of Article 15 GDPR across more than 44 million broadcasting contribution accounts would impose a disproportionate administrative and financial burden capable of undermining that public interest. The Court also held that § 11(8) RBStV satisfied the safeguards required under Article 23(2) GDPR by specifying the purposes of processing, categories of personal data, scope of the restriction, safeguards against misuse and unlawful access, the identity of the Controller, applicable storage periods and other statutory protections. Accordingly, while the Controller was required to disclose the categories of information specified under § 11(8) RBStV, it was not required to provide a copy of all personal data processed under Article 15(3) GDPR. As the Controller had already provided all information required under the national provision, the court dismissed the action.

### OVG Saarlouis - 2 A 165/24

*Source: Superior Administrative Court Saarlouis, 2025-05-13 — https://overview.legal/posts/125590 — original: https://gdprhub.eu/index.php?title=OVG_Saarlouis_-_2_A_165/24*

Facts — The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15 GDPR. They did not respond. On 28 January 2022, the controller terminated the employment. On 17 February 2022, the data subject lodged a complaint with the Data Protection Authority (DPA) under Article 77 GDPR. The data subject alleged that the controller had failed to answer the access request, had taken unauthorised photographs, and had a copy of their vaccination certificate. On 24 February 2022, the employment relationship ended by a court settlement before the Labour Court. The settlement stated that all claims arising from the employment relationship and its termination, whether known or unknown and regardless of their legal basis, were settled, except for employment documents. By entering the settlement, the data subject agreed to not pursue further claims. After the settlement, the controller informed the DPA that it had not received an access request from the data subject, had not taken photographs, and had destroyed the vaccination certificate after the employee left. The data subject continued to raise issues with the DPA, including access to time-tracking data and alleged inaccuracies in the controller’s provided documents. The controller later provided partially redacted time-tracking data. On 26 July 2022, the DPA closed the administrative procedure, as it considered that the data subject no longer had a right of access under Article 15 GDPR because the settlement didn't allow for this claim. The data subject challenged the DPA’s decision before the Administrative Court. On 10 July 2024, the court dismissed the action. The data subject appealed. Holding — First, the court held that the right of access under Article 15 GDPR was, in principle, waivable. Although Article 8(2) CFR protects the right of access, the court noted that data protection law is based on self-determination, including the possibility to consent to processing under Article 7 GDPR. From this, the court inferred that a data subject could also waive the exercise of the right of access. Second, the court clarified that a waiver could not generally cover unknown future data processing. However, a waiver relating to past processing was permissible, especially after the end of an employment relationship, where the imbalance between employee and employer no longer existed. Third, the court held that the specific settlement covered the right of access under Article 15 GDPR. The clause settling all claims arising from the employment relationship and its termination, whether known or unknown and regardless of their legal basis, also included secondary claims linked to the employment relationship, such as access rights concerning employee data. The court considered the wording sufficiently clear and found no requirement to explicitly mention data protection rights. Fourth, the court noted that the data subject already knew about the access request and had raised it before concluding the settlement. Any internal intention not to waive data protection rights was legally irrelevant. Finally, the court upheld the DPA’s decision to close the procedure. Since the data subject had waived the right of access under Article 15 GDPR for past processing through the settlement, the DPA had no obligation to continue enforcement action against the employer.

### Svea Hovrätt - T 10711-21

*Source: Svea Court of Appeal, 2022-10-07 — https://overview.legal/posts/122858 — original: https://gdprhub.eu/index.php?title=Svea_Hovrätt_-_T_10711-21*

Facts — The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead. Holding — The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of Article 57(1)(f) GDPR that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case. Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. Article 15(3) GDPR on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR. According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data. In line with Article 15(3) GDPR, the data subject had the right to receive a copy of their personal data as it is a prerequisite for other rights in the GDPR to apply, for example the right to erasure. A transcript of phone conversations - which they had already obtained - cannot satisfy the right in this regard. Therefore, the data subject had the right to obtain a copy of the bank's recordings of their voice. Unlike the District Court, the Court of Appeal ruled that there are conditions for obliging the bank to hand over the parts of the audio recordings where the man's voice was heard, but not the parts where the employees' voices were heard. The second person's voice did not in itself constitute personal data with respect to the data subject.

### VG Berlin - 42 K 25/25

*Source: Administrative Court Berlin, 2026-06-17 — https://overview.legal/posts/262250 — original: https://gdprhub.eu/index.php?title=VG_Berlin_-_42_K_25/25*

Facts — A Jehovah’s Witnesses congregation (the controller) sent another congregation an introductory letter containing the personal data of two members (the data subjects) who were changing congregations from the controller to the recipient. The data subjects did not receive a copy of this letter despite their request. They filed a complaint with the DPA of Jehovah's Witnesses in July 2023, stating that their right of access under the GDPR had been violated. The controller argued that providing access to the introductory letter would undermine confidentiality required by religious law. According to the controller, restricting the right of access was necessary to allow the elders of the congregations to fulfill their biblical mandate to care for the members as shepherds of God’s flock. The controller only provided the data subjects a short list of information about them contained in the letter. The DPA dismissed the complaint as unfounded in May 2024. It held that the restriction to the right of access was justified under Article 91(1) GDPR and the national Jehovah’s Witnesses Data Protection Act (DSGJZ), as providing access would jeopardise the religious community’s ability to fulfill its mission. The data subjects filed a lawsuit before the Administrative Court of Berlin in May 2024, claiming the right to obtain a copy of the introductory letter. Holding — The court ordered the controller to provide the data subjects access to their personal data undergoing processing by handing over a copy of the introductory letter addressed to the data subjects’ new congregation. First, the court referred to the principle of primacy of EU law and held that Article 91(1) GDPR gives precedence to the data protection rules of religious associations or communities only insofar as these rules comply with the GDPR. Second, the court concluded that the data subjects were entitled to receive the requested copy pursuant to Article 15(1) GDPR in conjunction with Article 15(3) GDPR. The court considered a merely abstract overview of the processed data insufficient for verifying the lawfulness of processing. Furthermore, it assumed that the whole letter contained personal data and must therefore be disclosed in its entirety.

### GC T-318/24: EPSO access logs and Article 17 access requests under Regulation 2018/1725

*Source: Gereral Court, T-318/24, 2025-12-03 — https://overview.legal/posts/122878 — original: https://gdprhub.eu/index.php?title=GC_-_T-318/24*

Facts — An applicant (the data subject) participated in several EU staff selection procedures administered by the European Personnel Selection Office (EPSO), acting as controller, and created an EPSO account in the Talent system. After he successfully passed one selection procedure, EPSO also stored his data in its recruitment portal. EPSO managed recruitment through two IT systems, both of which generated access logs, although those logs contained limited technical information regarding the purpose of each access. Between 2022 and 2024, the data subject submitted several requests to EPSO under Article 17 of Regulation (EU) 2018/1725, seeking access to all personal data concerning him. He requested, in particular, full access logs, minutes of meetings, internal and external communications containing his personal data, information on data recipients, and the restoration of personal data deleted after the expiry of retention periods. EPSO stated that certain data did not exist, that it could not restore lawfully deleted data, and that it had already disclosed all available log data. After the data subject lodged a complaint, the European Data Protection Supervisor (EDPS) reconsidered the matter in light of the CJEU’s judgment in Pankki. The EDPS ordered EPSO to provide all available log data relating to consultations of the data subject’s profile. EPSO complied with that order by disclosing the available logs but withheld the identities of individual staff members who had accessed the data. EPSO later rejected further access requests submitted by the data subject. As a result, the data subject brought two actions before the General Court (Cases T-318/24 and T-362/24), seeking the annulment of EPSO’s decisions. The General Court joined the two cases and examined together all the pleas in law raised by the data subject. Holding — The General Court dismissed both actions in their entirety. It held that the controller did not infringe Article 17(1) or (3) of Regulation 2018/1725, as the right of access concerns personal data undergoing processing and not documents as such, nor does it require the controller to restore lawfully deleted data. The Court confirmed that Regulation 2018/1725 contains no obligation for a controller to reinstate personal data once deleted in compliance with applicable retention rules. The Court further held that the controller had no obligation to disclose additional log data, meeting minutes, or communications where it credibly asserted that no such personal data existed. The data subject failed to rebut the presumption of legality attaching to the controller’s statements regarding the non-existence of further data. Moreover , The Court held that access logs constitute personal data to which a data subject is entitled, as they reveal the existence, frequency and purpose of processing. However, employees of a controller acting under its authority are not “recipients” within the meaning of the GDPR or Regulation 2018/1725, and controllers are not required to log or disclose their identities. Disclosure of such identities is only required if strictly necessary for the effective exercise of data protection rights and subject to safeguarding employees’ rights. Since the data subject had already been informed of the purposes and recipients of processing, the absence of staff identities or detailed purposes in the logs did not infringe the right of access. It is not further apparent from the Pankki that Article 15 GDPR requires the controller to set up a logging mechanism containing information on the identity of employees who have carried out consultation operations in respect of the personal data of a person. In addition, the Court found no infringement of the principles of lawfulness, fairness, transparency, accuracy, integrity, confidentiality, or accountability under Article 4 of Regulation 2018/1725. The deletion of the data subject’s data after the expiry of retention periods was lawful and the data subject’s rights to restriction of processing and objection under Articles 20 and 23 were not applicable, as the deletion was based on a legal obligation rather than consent or legitimate interests.

### Proceedings brought by J.M

*Source: Court of Justice of the European Union, C-579/21, 2023-06-22 — https://overview.legal/posts/132284 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0579*

In Case C-579/21, the Court of Justice of the European Union ruled on a preliminary reference from the Itä-Suomen hallinto-oikeus (Administrative Court of Eastern Finland) concerning a dispute between J.M. and Pankki S, a Finnish bank, after the Apulaistietosuojavaltuutettu (Assistant Data Protection Supervisor) rejected J.M.'s request for access to certain log data. The core issue was the scope of the right of access under Article 15 of the GDPR, specifically whether log data containing information about who accessed personal data and when constitutes "personal data" and whether the controller must communicate the identities of recipients. The Court held that log data relating to consultations of a data subject's personal data constitutes personal data under Article 4(1) of the GDPR, and that a data subject is entitled to obtain the identities of recipients of their data, subject only to exceptions expressly provided by law or overriding rights of third parties. No fine was imposed as this was a preliminary ruling proceeding.

### BVwG - W605 2289290-2/18E

*Source: Federal Administrative Court, 2026-07-14 — https://overview.legal/posts/353784 — original: https://gdprhub.eu/index.php?title=BVwG_-_W605_2289290-2/18E*

Facts — The data subject received social benefits from a public authority (controller) because of their unemployment. The controller has established an investigation unit that investigates undeclared workers and people who refuse to work but receive benefits. Employees from that investigation unit visited the data subject’s address and took pictures in the context of an investigation into possible income from self-employed work. The data subject requested from the controller access to their personal data processed by the controller pursuant to Article 15 GDPR. The controller submitted the data to the data subject. In an additional access request, the data subject requested information as to the number of photos taken at the address of the data subject, what objects were depicted, which employees took those pictures and with what justification. As a response, the controller sent six pictures that were taken at the address of the data subject in PDF format to the data subject. Three pictures were taken from the public pavement and depicted a poster and an advertisement placard, both visible from the public pavement. Three other pictures depicted the data subject’s car and house. The data subject lodged a complaint with the DPA, claiming incomplete access to their personal data, especially because the controller failed to provide them with information concerning the employers who conducted the investigation against them and meta data of the pictures, including technical data of the pictures. The DPA rejected the complaint and the data subject appealed it to the Federal Administrative Court (BVwG). Holding — As far as the scope of the access request was concerned, the Court held that the data subject has narrowed the scope of the subject matter of the access request to the pictures and the justification to take them by specifying those matters in their request. Since the access request is triggered by the request of the data subject, the request can limit the scope of what the DPA has to decide on, and thus, define the subject matter in the proceeding before the Court. Concerning the access to specific documents, the Court held that the access request can only include the information mentioned in Article 15 GDPR. In specific cases, in order to fulfill the obligation under Article 15 GDPR, it is necessary for the controller to provide whole documents in which the personal data is included. However, Article 15 GDPR does not stipulate a right to access to documents. Article 15(3) GDPR that stipulates that the controller shall provide a copy of personal data, must be understood as specifying a means of providing the information pursuant to Article 12 GDPR. It depends on the individual case whether the controller is required to provide whole documents or whether they fulfil their obligation by providing a register of the personal data. As far as access to data about the employees who took the pictures was concerned, the Court held that the right to access does not include the personal data of third persons. This is also true for the meta data requested. Moreover, according to the Court, the controller fulfilled their access request by providing the six pictures and information of the modalities of taking the pictures and the justification thereof. The data subject’s claim of the existence of more than those six pictures was unfounded according to the Court. The data subject was unable to demonstrate any facts that point to the existence of further pictures. However, it is for the data subject to prove that the access was incomplete. Mere speculation is not sufficient for the Court to investigate into the existence of further pictures. In conclusion, the Court confirmed the DPA decision that the controller did not violate Article 15 GDPR and gave complete access.

### BVwG - W254 2253351-1

*Source: Federal Administrative Court, 2025-11-14 — https://overview.legal/posts/353783 — original: https://gdprhub.eu/index.php?title=BVwG_-_W254_2253351-1*

Facts — The data subject requested access under Article 15 GDPR from the controller (a credit information agency). The controller provided the personal data it held, including the data subject's name, date of birth, address and business role, as well as information about the sources of those data. The data subject considered the response incomplete and requested further information. The controller provided additional information, including the companies that had queried the data subject's creditworthiness between 2014 and 2021 and the credit scores disclosed to them. The data subject then lodged a complaint with the DPA. The data subject argued that the controller processed more personal data than it had disclosed, pointing in particular to the broader categories listed in the controller’s privacy notice and the absence of information about certain data sources. During the DPA proceedings, the controller provided another response, saying that the credit score could change based on statistical criteria linked to economic developments, which it considered non-personal. The data subject appealed the DPA's decision. During the court proceedings, the controller provided further information. It explained that the credit score was calculated using, among other things, payment history data, name, age, sex, address, and the first and last confirmation of the address. However, the controller still did not disclose the specific data covered by the statistical parameters linked to general economic developments that it had used when calculating the data subject’s credit score. Holding — First, the court rejected the argument that the controller must have processed additional personal data merely because its privacy notice listed broader categories of data. The privacy notice described data that the controller could theoretically process, but this did not establish that the controller actually processed those data in relation to the data subject. Second, the court examined whether the statistical parameters used in calculating the credit score constituted personal data under Article 4(1) GDPR. It relied on the broad definition of personal data and the principle that information becomes information “about” a person when its content, purpose or effect links it to that person. The court also referred to existing case law recognising that statistical probability statements can constitute personal data when they provide an assessment relating to an identified or identifiable person. It applied that reasoning to the credit-scoring process. Although the statistical parameters relating to general economic developments did not themselves relate to the data subject, the controller fed them into the algorithm used to calculate that particular person's credit score. By doing so, the controller linked the parameters to the data subject and used them to make an assessment of that person's creditworthiness. The parameters therefore became personal data within the meaning of Article 4(1) GDPR. As a result, Article 15(1) GDPR also covered those statistical parameters. Finally, the court partly upheld the appeal and held that the controller had violated the data subject’s right of access under Article 15(1) GDPR by failing to disclose the statistical data relating to the data subject that it had used to calculate the credit score. It otherwise upheld the DPA's assessment that the controller had provided complete information about the other personal data it processed and their sources and rejected the remainder of the appeal.

### Österreichische Datenschutzbehörde v CRIF

*Source: CJEU, C-487/21, 2023-10-26 — https://overview.legal/posts/51486 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0487*

Right of access includes obtaining a copy in commonly used electronic form.

### RW v Österreichische Post AG

*Source: Court of Justice of the European Union, C-154/21, 2023-01-12 — https://overview.legal/posts/132299 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0154*

The Court of Justice of the European Union (First Chamber), in response to a preliminary reference from the Oberster Gerichtshof (Austrian Supreme Court), interpreted Article 15(1)(c) GDPR in proceedings between data subject RW and Österreichische Post AG regarding the scope of the right of access to information about recipients or categories of recipients of personal data. The Court held that controllers must provide the actual identities of specific recipients to whom personal data have been or will be disclosed, rather than merely naming categories of recipients, unless a further specification is impossible. The Court clarified that while the right of access under Article 15(1)(c) is not absolute and may be balanced against the rights and freedoms of others, including trade secrets, such restrictions must not result in a refusal to provide all information to the data subject.

## Guidance

### One-Stop-Shop case digest on right of access

*Source: EDPB, oss-case-digest-right-of-access-en, 2025-01-16 — https://overview.legal/posts/50410 — original: https://www.edpb.europa.eu/documents/support-pool-of-experts/one-stop-shop-case-digest-on-right-of-access_en*

EDPB/SPE 16 jan 2025 One-Stop-Shop case digest on right of access. Een rapport opgesteld door Hanne Marie Motzfeldt (Københavns Universitet) waarin beslissingen inzake het inzagerecht onder het eenloketmechanisme worden geanalyseerd.

### Guidelines 01/2022 on data subject rights - Right of access

*Source: EDPB, edpb-guidelines-on-data-subject-rights---right-of-access, 2023-04-17 — https://overview.legal/posts/38055 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en*

The right of access of data subjects is enshrined in Art. 8 of the EU Charter of Fundamental Rights. It has been a part of the European data protection legal framework since its beginning and is now further developed by more specified and precise rules in Art. 15 GDPR.

### Coordinated Enforcement Action, implementation of the right of access by controllers

*Source: EDPB, edpb-cef-report-2024-20250116-rightofaccess-en, 2025-01-20 — https://overview.legal/posts/50412 — original: https://www.edpb.europa.eu/documents/coordinated-enforcement-framework/coordinated-enforcement-action-implementation-of-the_en*

EDPB 20 jan 2025, Coordinated Enforcement Action, implementation of the right of access by controllers.

### Guidelines 10/2020 on restrictions under Article 23 GDPR

*Source: EDPB, edpb-guidelines-on-restrictions-under-article-23-gdpr, 2021-10-13 — https://overview.legal/posts/38062 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-102020-on-restrictions-under-article-23-gdpr_en*

The European Data Protection Board (EDPB) issued these guidelines to clarify the scope and application of Article 23 of the GDPR, which allows Member States to restrict certain data subject rights and controller obligations. The guidelines outline the necessary conditions and safeguards, emphasizing that any restrictions must respect the essence of fundamental rights and be implemented via foreseeable, proportionate legislative measures. This document serves as authoritative guidance for interpreting the specific grounds and requirements under which Member States may legally impose such limitations.

### Coordinated Enforcement Action,

*Source: EDPB, coordinated-enforcement-action-implementation-right-erasure-en, 2026-03-02 — https://overview.legal/posts/53740 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/other/coordinated-enforcement-action-implementation-right-erasure_en*

EDPB, Coordinated Enforcement Action, implementation of the right to erasure by controllers

### Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation

*Source: EDPB, edpb-opinion-202507-epo-adequacydecision-en, 2025-05-06 — https://overview.legal/posts/50823 — original: https://www.edpb.europa.eu/documents/adequacy/opinion-072025-regarding-the-european-commission-draft-implementing-decision_en*

EDPB, Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation, 2025.

### EDPB- EDPS Joint Opinion 01/2025 on the Proposal for a Regulation on simplification measures for SMEs and SMCs, in particular the record-keeping obligation under Art. 30(5) GDPR

*Source: EDPB, edpb-edps-jointopinion-202501-proposalsimplification-en, 2025-07-09 — https://overview.legal/posts/50980 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-012025-on-the-proposal-for-a-regulation-on_en*

De EDPB en EDPS steunen het doel om de administratieve lasten voor SMCs en MKB te verminderen, mits dit de bescherming van fundamentele rechten niet verlaagt. Ze benadrukken de noodzaak van een evenwichtige en proportionele aanpak en vragen om verduidelijking van de nieuwe drempel van 750 werknem...

### EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (

*Source: EDPB, edpb-edps-joint-opinion-22026-proposal-en, 2026-02-11 — https://overview.legal/posts/53739 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal_en*

EDPB, EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus)

## Enforcement decisions

### Garante warns ReLife Recycling for failing to timely respond to GDPR access request

*Source: Garante per la protezione dei dati personali (Italy), 2026-09-08 — https://overview.legal/posts/353785 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_515/2026*

Facts — The data subject sent a complaint to the DPA regarding correspondence between him and the company ReLife Recycling s.r.l. (the controller), which was sent without his consent to third parties, amongst which one of the third parties already had a consulting contract with the data subject. The data subject exercised his rights pursuant to Articles 15- 22 GDPR however received no response from the controller. The DPA asked the controller to respond within which it found out that the controller had sent a delayed response due to a series of reorganisations. The controller also clarified that they do not process personal data and the only information relating to the data subject was that present in the emails. The controller explained that the forwarding of the email was exclusively for commercial purposes. Holding — The DPA held that the controller failed to respond to the access request in violation of Article 12(3) GDPR, by not informing the data subject within one month of receiving the request the reasons for the controller’s delay, and his possibility to lodge a complaint with a supervisory authority and seeking judicial remedy in violation of Article 12(4) GDPR. Given the minor nature of the controller’s violations, the DPA issued a warning to the controller.

### IP Slovenia: Controller breached Art. 15(1)(d) and 15(3) GDPR by denying storage info and

*Source: IP (Slovenia), 2026-09-08 — https://overview.legal/posts/353782 — original: https://gdprhub.eu/index.php?title=IP_(Slovenia)_-_0602-68/2025/18*

Facts — The data subject made an access request asking for (i) a copy of their personal data processed by the controller and (ii) information on the envisaged storage period of this data. The copy request concerned specifically a copy of a document related to the controller’s defense in another proceeding that also contained personal data of third parties. The controller refused to provide a copy of the requested document on the grounds that even a partial disclosure of the document by redacting the personal data of other individuals would disproportionately interfere with the rights of third parties. Regarding the storage period, the controller explained that it stores personal data in accordance with applicable law, which specifies storage periods for specific types of documentation. Following the controller's refusal to provide the requested information, the data subject lodged a complaint with the DPA. Holding — First, the DPA held that the controller had violated Article 15(1)(d) GDPR in conjunction with Article 12 GDPR by failing to provide the data subject sufficiently detailed information on the envisaged storage period for their personal data or the criteria used to determine that period. Second, the DPA concluded that the controller had violated Article 15(3) GDPR by rejecting the data subject’s request for a copy of their personal data. The DPA referred to the CJEU’s decision in the case C-487/21 Österreichische Datenschutzbehörde and CRIF to support its conclusion. In this decision, the CJEU clarified that the right to obtain a copy of the personal data being processed also includes the right to obtain copies of extracts from documents or entire documents under certain conditions. In the present case, the DPA held that merely providing the data subject a list of their personal data would not enable them to effectively exercise their rights under the GDPR. It also took into account that the document only contained a small amount of third parties’ personal data. Therefore, the DPA ordered the controller to provide the data subject sufficient information on the storage period of the personal data the access request concerned, as well as a copy of the document the data subject had requested with the personal data of third parties redacted.

### AEPD: Data subject entitled to identity of professionals who accessed medical records

*Source: AEPD (Spain), 2026-09-15 — https://overview.legal/posts/353917 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_pd-00055-2026*

Facts — Suspecting unauthorised access to his medical records, a public civil servant, the data subject, requested the Ministry of Defence, the controller, to provide a log copy of accesses to his medical history, including the date, time, identity of the professional and purpose of each access. The controller rejected the request, relying on Article 15(4) GDPR and Article 18(3) Law 41/2002. It argued that identifying the professionals who had accessed the medical history would involve disclosing personal data of third parties. Instead, it provided general information concerning the processing of the data subject's personal data. The data subject subsequently reiterated his request and the controller again refused to disclose the identities of the persons who had accessed the records. During the proceedings, the controller carried out an audit of the accesses recorded since 2023. It concluded that the accesses identified had been made for justified purposes by administrative or healthcare personnel and that no unauthorised access had occurred. Regarding older information from 2016 to 2023, the controller stated that retrieving the relevant records from historical databases would require extraordinary technical and financial resources. The data subject argued that access information, including the identity of professionals, had previously been provided to him and maintained that organisational or technical difficulties could not justify limiting his rights. Holding — The DPA upheld the complaint and found an infringement of Article 15 GDPR. The DPA first recalled that Article 15 GDPR allows data subjects to obtain access to personal data concerning them and must be interpreted together with the transparency principle under Article 5(1)(a) GDPR and the accountability obligations under Articles 5(2) and 24 GDPR. It also considered that appropriate technical and organisational measures under Article 25 GDPR should enable the traceability and control of access to personal data. Regarding the identity of employees who accessed the data, the DPA referred to CJEU Case C-579/21. It acknowledged that Article 15 GDPR does not generally require controllers to disclose the identity of individual employees who accessed personal data and that providing categories of employees may normally be sufficient. However, their identity may have to be disclosed where this is necessary for the effective exercise of the data subject's rights, subject to the rights and freedoms of those employees. The DPA considered that a stricter transparency standard applies in the healthcare context because health data constitute special categories of personal data. It referred in that regard to the approach introduced by the not yet applicable Regulation (EU) 2025/327 on the European Health Data Space. Accordingly, the DPA held that, as a general rule, the right of access to information concerning access to health data includes the identity of the persons who accessed those data where this is necessary to ensure transparency and enable the data subject to effectively control the lawfulness of the processing. However, this right is not absolute. The controller may restrict disclosure where proportionate and under specific circumstances. The DPA therefore rejected the controller's blanket reliance on Article 15(4) GDPR and Article 18(3) Law 41/2002. It found that automatically excluding disclosure of the identity of all persons who accessed the medical records was incompatible with the enhanced transparency required in the healthcare context. The controller had neither provided the requested information nor demonstrated specific circumstances justifying its refusal. The DPA also found that the controller failed to fully comply with the access request in accordance with Articles 12 and 15 GDPR. Consequently, it ordered the controller, within ten working days, either to provide the requested access information or to issue a properly reasoned refusal explaining why disclosure was not justified. No administrative fine was imposed.

### DSB: No processor access violation under Art. 15 GDPR when controller deleted data

*Source: DSB (Austria), 2025-11-21 — https://overview.legal/posts/291428 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_DSB-D124.0531/24*

Facts — On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request, stating that they would receive a final report and that all required documents were provided to the controller. The data subject sent a request to the controller on 30. September 2023, specifically asking for access to personal data, which remained unreplied. The questionnaire had already been deleted at that time. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. During the proceedings, data relating to a project involving the data subject was deleted. Holding — First, the DPA held that the processor had not violated the right to access under Article 15 GDPR as there was no evidence of contractual violations between the processor and the contractor under Article 28(10) GDPR. As defined in Article 4(8) GDPR, the processor processes personal data on behalf of the controller and thereby acts as their "extended arm". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under Article 28(10) GDPR. This concludes to the controller's responsibility to ensure that the data subjects can exercise their rights, with the processor providing support where possible. Second, the DPA held that both the email from 30. September 2023 and the email of 13. January 2024 did constitute information requests under Article 15 GDPR. The data subject simply requested the transmission of information, namely the report and the questionnaire and did not refer to personal data. Third, the DPA held that the disposal of project data during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with Article 5(1)(a) GDPR. The deletion of personal data that is subject to an access request that has already reached the controller violates Article 15 GDPR. This is because the deletion makes it impossible for the DPA to investigate in a possible breach of the access right. However, the deletion of the questionnaire right after the initial interview had happened before the data subject's first email on 08. August 2023 and was thus lawful. Fourth, the DPA held that a right to receive the documents containing processed personal data could not be recognised under Article 15 GDPR in conjunction with Recital 63 GDPR per se, the provision of a copy is just a modality of the access request. It depends on the individual case whether the controller must provide the documents or just a register of the personal data.

### DSB (Austria) - DSB-D124.2437/25

*Source: DSB (Austria), 2026-01-09 — https://overview.legal/posts/291441 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_DSB-D124.2437/25*

Facts — The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all personal data processed about him including specific categories of data, processing purposes, recipients, storage periods, data origin, any automated decision-making, a copy of his data in electronic format and what data had been processed by two named individuals (a doctor and a body therapist working for the controller) and whether either had disclosed his data to third parties. The controller's chairperson replied by email on 12 August 2025, attaching a PDF of the data collected from the data subject and a list of medications, noting the data originated from a named doctor and that there was no planned retention period. The reply stated that data recorded by the body therapist existed only in handwritten form and had not been electronically processed and offered to send the data subject a copy by post or email. The reply did not include information on the purposes of processing, categories of data, recipients or categories of recipients, or the criteria used to determine retention periods. The data subject filed a complaint with the Austrian DPA, alleging that the access provided was incomplete. Despite being invited to comment twice by the DPA, the controller did not respond at any point during the proceedings, although a delivery receipt confirmed it had received the correspondence. Holding — First, addressing the controller's failure to participate in the proceedings, the DPA held that although it is required to investigate matters on its own initiative, a party's persistent failure to cooperate despite repeated invitations may properly be taken into account in the DPA's free assessment of evidence, rather than obliging the DPA to conduct further investigations of its own accord. On this basis, the DPA treated the data subject's account of events, including that no further information had been provided beyond the 12 August 2025 email, as established. Second, on the scope of the complaint, the DPA reiterated that in a complaint-based procedure, the content of the complaint itself defines and limits the subject matter of the proceedings. The DPA can only rule on what was actually raised. The data subject's complaint was based on the incompleteness of the access provided, specifically regarding the handwritten notes and the missing meta-information. Third, on the handwritten notes, the DPA held that the GDPR's material scope extends not only to automated processing but also to non-automated processing where the data form part of a "filing system" under Article 4(6) GDPR defined broadly by the CJEU case-law C-740/22 as any structured collection of personal data accessible according to specific criteria that make data easily retrievable. The DPA held that although the controller had not specified how the therapist's handwritten notes were organised, it could reasonably be assumed that such clinical notes on patients are typically structured by criteria such as name or treatment period to ensure future retrievability, consistent with professional standards of care in the therapeutic field. On this basis, the DPA held that the notes fell within the GDPR's material scope and that the data subject was entitled to access the personal data they contained, so the complaint was well-founded on this point. Fourth, on the missing meta-information, the DPA held that Article 15(1) GDPR entitles a data subject not only to the specific personal data processed but also to the accompanying information listed in Article 15(1)(a)-(h) GDPR, including processing purposes, categories of data, recipients or categories of recipients and criteria for determining storage periods. Since the controller's response of 12 August 2025 included none of this information, the complaint was also well-founded on this point. The DPA accordingly upheld the complaint and found a violation of the right of access. Citing CJEU case-law C-46/23 on the DPA's obligation to adopt appropriate corrective measures once a violation is established, the DPA ordered the controller, under Article 58(2)(c) GDPR, to fully comply with the data subject's access request including disclosure of the handwritten notes and the outstanding meta-information within four weeks.

### Datatilsynet (Denmark) - 2023-31-0321

*Source: Datatilsynet (Denmark), 2026-08-18 — https://overview.legal/posts/291258 — original: https://gdprhub.eu/index.php?title=Datatilsynet_(Denmark)_-_2023-31-0321*

Facts — A customer of a bank ('the data subject'), suspected that their former spouse, who was employed by the same bank ('the controller'), was accessing their accounts and decided to switch banks. In order to make this change, the data subject was charged a number of fees, and subsequently filed a complaint with the Financial Appeals Board. The director of the bank offered to reimburse the fees in return for the case at the Appeals Board to be closed. On 20 March 2023 the data subject agreed to the reimbursement and requested access to the employee's access log’s pertaining to the data subject's accounts between the period of 2015-2021. One day later the director made the reimbursement of the fees conditional upon the complainant giving up their access request. 20 June 2023 the controller informed the data subject that they requested the data subject's former spouse to explain and substantiate the access to the account. The former spouse stated that they where looking at the account as a customer and not an employee. The controller investigated, however the logs of the use of the system did not go that far back. Correspondingly, the controller requested its data center to recover the logs but was faced with costs of about DKK 300,000 without the guarantee of the recovery being successful. The controller emphasised that customers may not request employees’ access logs, and that the costs would not be proportionate to the clarification which the data subject would receive. This was communicated to them. Holding — The DPA, following the CJEU in C-579/21 Pankki S, maintained that the information appearing within the logs concerning employees access to a customer’s account are covered by the right of access in Article 15 GDPR. Nonetheless, considering the controller informed the data subject that the requested log information is no longer available, and that the requested logs do not fall under the retention obligation pursuant to Article 30 of the national Anti-Money Laundering Act, the DPA rejected the explanations of the controller regarding the requested logs. Considering the data subject's access request, the DPA considers that the controller infringed Article 12(2) GDPR, whereby controllers are to facilitate the exercise of data subject rights. The DPA emphasised that controller made the repayment of the fees conditional upon the complainant revoking their access request. The DPA further considered that between 23 March 2023 and 20 June 2023 the controller did not reach out to the complainant. The DPA held that if that were the case, the controller should have, no later than a month after the data subject's request, informed the data subject about the reasoning, and possibility of complaining to the DPA or bringing the matter to court under Article 12(4) GDPR. The DPA reprimanded the controller as regards the insufficient handling of the data subject’s request for access under Article 12(2), (3), (4) GDPR.

### HDPA 23/2020: Complaint against HEDNO S.A. for denial of employment certificate

*Source: HDPA (Greece), 2020-07-30 — https://overview.legal/posts/158445 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_23/2020*

Facts — The data subject filed an application to the Human Resources Directorate of the Hellenic Electricity Distribution Network Operator S.A. [HEDNO S.A.] for the purposes of obtaining an up-to-date certificate of employment that was needed in view of their transfer to another position at the National Centre of Audiovisual Media and Communication S.A. [NCAM S.A.]. The HEDNO S.A. denied the issuing of such a certificate. The company's response to the application focused on the fact that HEDNO S.A. is no longer a legal person of public law, but has been transformed into a legal person of private law (already from the 1st of May of 2012) and its employees' relation to the company is governed by private law and, thus, its employees do not fall under the categories of employees that can be consider for a job post in NCAM S.A. (namely all employees serving either permanently or under an open-ended contract of private law at institutions of the General Government or of the Broader Public Sector or of the Local Authorities of the first or second degree). Therefore, according to the HEDNO S.A. the issuing of any such certificate of employment or the consideration of their employee for such a job post is not in accordance with the legal framework governing the company itself and the employee's relation to it. Eventually, during the consideration of the complaint by the HDPA, the HEDNO S.A. provided the complainant with the requested certificate of employment, an event that was confirmed both by the HEDNO S.A. and by the complainant themselves. Dispute — The HDPA considered the following legal issues; Did the HDPA have the necessary jurisdiction to rule on the complaint under question regarding the possible violation of the data subject's right to access their data based on Article 15 GDPR and the jurisdiction to rule on the issue of the legality of the complainant's candidacy for a job transfer to NCAM S.A.? Was the complainant's right to access their data (Article 15 GDPR) violated by the HEDNO S.A.? Does the issuing on the data subject's request of a certificate regarding personal data based on the record held by the data processor fall within the protection of the data subject's right to access their data under Article 15 GDPR? Holding — The HDPA held that it had the necessary jurisdiction to rule only upon the complaint of the complainant regarding a possible violation of their right to access their data (Article 15 GDPR), and not on the issue of the legality of the complainant's candidacy for a job transfer to NCAM S.A. The HDPA, having taken into account the principles relating to the processing of data (Article 5 GDPR) and having underlined that the data subject's right to access their data is not an absolute right, but a right that is estimated in relation to its function within the society and a right that can be cogitated in relation to other fundamental rights but always on the basis of the principle of proportionality (Article 8(1) CFR, Article 9A Greek Constitution, Recital 64 GDPR), underlined that the GDPR totally respects all fundamental rights and freedoms included in the European Charter of Fundamental Rights and in the [European Union] Conventions. Additionally, the HDPA analysed in detail the content of the data subject's right to access their data and came to highlight that the data subject has the right to know whether their personal data are being processed, the right to access these data without having to prove a special legal interest for doing so, and the right to exercise these rights easily and frequently so as to be informed of the data processing and to be able to verify its legality (Articles 12 & 15 GDPR, Recital 63 GDPR). Furthermore, the HDPA underlined that a certificate of employment contains, on a first basis, personal data referring to a certain employee and, thus, this employee as a data subject has the right to access these data. The HDPA, though, made it clear that issuing a certificate of employment in order to fulfil such an employee's request requires the further processing of the personal data of the employee under question already existing in the data processor's records. Thus, every time an employee requests the issuing of a certificate of employment, they are actually asking the employer/data processor to further process their data in order to create a new document that did not exist in the records up until then. Therefore, the HDPA noted that the refusal to issue a certificate of employment, meaning a document that has not yet been created, cannot constitute the rejection of a data subject's request to access personal data, since the respective legal provisions protect the data subject's right to have knowledge of all the data already existing within the data processor's records at the time of the issuing request and the right to be able to examine the legality of the collection and storing of the data concerned. It was due to the complexity and the greater importance of this issue that the HDPA decided to refer to the HDPA plenary the part of the case concerning the question whether the issuing on the data subject's request of a certificate regarding personal data based on the record held by the data processor falls within the protection of the data subject's right to access their data under Article 15 GDPR, while the HDPA also noted that the subject-matter of the specific complaint of the case was no longer existent, since the HEDNO S.A. did eventually provide the complainant with the requested certificate of employment.

### DSB: Art. 15 GDPR access right does not extend to full documents with third-party data

*Source: DSB, 2026-01-12 — https://overview.legal/posts/51913*

The data protection authority (DPA) has determined that, according to Article 15 of the GDPR, an individual has the right to access personal data relating to them, but this right does not extend to complete documents that contain information about third parties. Confidential communications and legal advice within disciplinary proceedings are excluded. The data protection authority (DPA) has determined that, according to Article 15 of the GDPR, an individual has the right to access personal data relating to them, but this right does not extend to complete documents that contain...

## Recent developments

### ANSPDCP (Romania) - Spitalul Veterinar Tineretului SRL

*Source: GDPRhub, 2026-10-09 — https://overview.legal/posts/593308 — original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Spitalul_Veterinar_Tineretului_SRL*

The DPA fined a veterinary clinic RON 5,242 (€1,000) for failing to give full access to the personal data of a data subject upon a request pursuant to Article 15 GDPR. English Summary. Facts. A data subject filed an access request with the veterinary clinic Spitalul Veterinar Tineretului SRL (controller) concerning copies of a telephone conversation and video recordings from within the controller’s premises covering a time period that the data subject was on the premises. The data subject was di

### Digital Omnibus reality check: 83.5% of access requests not properly answered

*Source: noyb - European Center for Digital Rights, 2026-04-16 — https://overview.legal/posts/53129 — original: https://noyb.eu/en/digital-omnibus-reality-check-835-access-requests-not-properly-answered*

Data Subject Rights The most commonly exercised right under the GDPR is the right of access to one’s personal data that is being processed by companies. After all, it’s often the prerequisite to know if there is inaccurate or unlawful personal data that needs to be corrected or deleted. However, a new analysis of noyb cases shows: Only 16.5% of all access requests noyb has sent to companies in the past 8 years received a satisfactory reply, while 53.7% of replies were incomplete – and almost 30%

### GDPR Omnibus: EU “simplification” far removed from real business needs

*Source: noyb - European Center for Digital Rights, 2026-03-05 — https://overview.legal/posts/53131 — original: https://noyb.eu/en/gdpr-omnibus-eu-simplification-far-removed-real-business-needs*

GDPR Policy Ever since the European Commission has published its Digital Omnibus proposal, discussions about the workload the GDPR creates for businesses in Europe have intensified. Among other things, the Commission wants to restrict the Right of Access, allegedly to reduce the regulatory burden. But do these changes actually reflect the needs of privacy professionals working at companies? To find out more, noyb conducted a survey asking Data Protection Officers (DPOs) which elements of the GDP

### Digital Omnibus: EU DPAs reject many proposed changes to the GDPR

*Source: noyb - European Center for Digital Rights, 2026-02-11 — https://overview.legal/posts/52485 — original: https://noyb.eu/en/digital-omnibus-eu-dpas-reject-many-proposed-changes-gdpr*

GDPR Policy The EDPB (combining all independent data protection authorities) and the European Data Protection Supervisor (EDPS) published a joint opinion expressing serious concerns about key elements of the proposed GDPR and ePrivacy changes in the so-called “Digital Omnibus” proposed by the European Commission. Specifically, the authorities strongly oppose the proposed narrowing of the definition of personal data. The opinion also question the need for various key proposals, such as the legal

### noyb win: Microsoft ordered to stop tracking school children

*Source: noyb - European Center for Digital Rights, 2026-01-27 — https://overview.legal/posts/52487 — original: https://noyb.eu/en/noyb-win-microsoft-ordered-stop-tracking-school-children*

Data Subject Rights noyb has scored another win in its proceedings against Microsoft 365 Education: The Austrian data protection authority (DSB) has decided that the company illegally installed cookies on the devices of a pupil without consent. According to Microsoft’s own documentation, these cookies analyse user behaviour, collect browser data and are used for advertising. Microsoft now has four weeks to comply and cease the use of tracking cookies. Decision by the Austrian DSB (DE)PR for prev

## Literature

### The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how

*Source: Przegląd Prawniczy Uniwersytetu im. Adam Mickiewicza, 2023-12-30 — https://overview.legal/posts/132546 — original: https://doi.org/10.14746/ppuam.2023.15.09*

The data subject’s right to access information on data processing has a very broad meaning. Considering the latest developments in this field (mainly the CJEU ruling on Austrian posts and EDPB guidelines) one can draw the conclusion that the controller’s right to protect its confidential in-formation is limited and less valuable than the data subject’s rights. However, this may lead to unfair and unequal treatment of companies and data subjects. When looking at this right in a more systematic pe

### The Court of Justice on the Excessiveness of Access Requests under the GDPR

*Source: European Journal of Risk Regulation, 2026-07-09 — https://overview.legal/posts/83502 — original: https://doi.org/10.1017/err.2026.10117*

Abstract This case note comments on the preliminary ruling of the Court of Justice of the EU in Case C-526/24 Brillen Rottler v TC of 19 March 2026, which addresses the abuse of rights under the General Data Protection Regulation (GDPR), specifically in the context of requests for access to personal data under Article 15 GDPR and compensation under Article 82 GDPR. First, the Court held that even a first access request may be regarded as “excessive” where the controller demonstrates that it was

### Between European GDPR and Italian FOIA: New Regulations on Data Protection and Right to Access

*Source: Atlanti, 2016-10-24 — https://overview.legal/posts/132541 — original: https://doi.org/10.33700/2670-451x.26.1.137-176(2016)*

The paper gives a brief account about the adoption of the new regulations on data protection and right to access introduced by the European Union and the Italian Republic. The texts of the two regulations are given, and a brief list about the present global situation is also given.

### Practitioner’s Corner ∙ Exercising GDPR Data Subjects’ Rights: Empirical Research on the Right to Explanation of News Recommender Systems

*Source: European Data Protection Law Review, 2020-01-01 — https://overview.legal/posts/132544 — original: https://doi.org/10.21552/edpl/2020/4/17*

### HOW GDPR TREATS AUTOMATED DECISION-MAKING

*Source: Journal Scientific and Applied Research, 2025-11-14 — https://overview.legal/posts/132599 — original: https://doi.org/10.46687/jsar.v28i1.435*

This article examines how the General Data Protection Regulation (GDPR) regulates automated decision-making, including profiling, in the context of personal data processing. It analyzes the main provisions of Article 22 of the Regulation, as well as the conditions under which fully automated decisions that produce legal effects or significantly affect data subjects are permitted. The article highlights the rights of data subjects – the right to human intervention, the right to express their poin

## Related topics

- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data
- **Supervision** — https://overview.legal/topics/supervision
  Oversight and enforcement by supervisory authorities
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Public Authority** — https://overview.legal/topics/public-authority
  Government bodies and their data processing activities

---
Generated by overview.legal · https://overview.legal/topics/right-of-access · 2026-10-13