Zpráva EDPB o uplatňování práva na přístup k osobním údajům

EDPB Report on the Exercise of the Right of Access to Personal Data

In mid-January of this year, the European Data Protection Board (EDPB) adopted a report on the implementation of the right of access by controllers. In accordance with this right, a data subject has the right to obtain confirmation from the controller as to whether their personal data is being processed and further has the right to access this data and other information, including, for example, the retention period, the purpose of processing, and more. In this report, the EDPB not only summarizes the results of coordinated investigations led by national supervisory authorities but also provides a number of recommendations for the identified problematic areas.

One of the important topics mentioned in the report is the insufficient awareness of data controllers about the right of access and their often-incorrect procedures when receiving such requests. According to the EDPB, based on the investigation results it appears that controllers incorrectly assess requests received. They often approach the requests inappropriately from the outset, as they do not consider them to be requests for access to personal data under the GDPR. Additionally, even if the requests are correctly assessed, controllers frequently make mistakes in the length of their retention period.

The report also addresses other findings, such as insufficient documentation of internal procedures or an overly broad interpretation of the limits to the right of access. As part of its recommendations, the EDPB anticipates adoption of guidelines at both the Board and national-authority levels. However, many specific corrective steps are directly mentioned in the report and data controllers can already ensure that they are complying with the GDPR when  the right of access is being exercised.

It is also worth mentioning that at its plenary session, the EDPB further adopted guidelines on pseudonymization and  position paper on interplay between data protection and competition law. All these documents can provide valuable guidance not only for the relevant authorities but also for data processors and controllers on the direction in which the development of personal data processing is heading.

For more information, please contact the authors of the article or other members of the EY team with whom you work.

Authors:

Kateřina Suchanová

Veronika Juhasová