RIGHT OF ACCESS BY THE DATA SUBJECT

Privacy

The right of access is enshrined as part of the fundamental right to data protection. The GDPR is the following: “The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed”. Everyone has the right to know the use that others make of their personal data. Also, the right of compulsory access to data controller to provide the interested party with all the information related to said treatment.

The right of access includes information on the purposes of processing, the categories of personal data processed, the recipients or categories of recipients, the planned duration of storage or the criteria for its definition, information on the rights of the interested party, such as rectification, deletion or restriction of the processing, right to object, instructions on the right to file a complaint with the authorities, information on the origin of the data, as long as they have not been collected from the same subject of the data, and there is a process of automated decision making, including profile analysis, with significant information on the logic involved, as well as the implications and expected effects of such procedures.

The article 15 of the GDPR is the following if someone want to access the information:

  1. The purposes of the treatment.
  2. The categories of personal data concerned.
  3. The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations.
  4. Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
  5. The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing.
  6. The right to lodge a complaint with a supervisory authority.
  7. Where the personal data are not collected from the data subject, any available information as to their source.
  8. the existence of automated decision-making, including profiling.

An individual is only entitled to their own personal data, and not to information related to other people (unless the information is also about them or acting on behalf of someone). Therefore, it is important that you establish whether the requested information is within the definition of personal data.