The majority of the complaints and queries the Data Protection Commission (DPC) receives concern individuals seeking to exercise their ‘right of access’ to their own data.
The General Data Protection Regulation (GDPR), under Article 15, gives individuals the right to request a copy of any of their personal data which are being ‘processed’ (i.e. used in any way) by ‘controllers’ (i.e. those who decide how and why data are processed), as well as other relevant information.
These requests must be responded to free of charge and in an accessible form, and controllers should seek to facilitate access requests being both made and responded to easily, including electronically where appropriate.
There are no special conditions that need to be satisfied in order for an individual to be entitled to make an access request. An individual can make an access request to any controller who they think might be processing their personal data. Individuals are entitled to confirmation of whether the controller is processing any of their personal data, which means any information which concerns or relates to them. Where that is the case, they are also entitled to a copy of their personal data.
Additional information individuals are entitled to includes.
- the purposes of the processing.
- the categories of personal data processed.
- who the personal data are shared with.
- how long the personal data will be stored.
- the existence of various data subject rights.
- the right to lodge a complaint with the DPC.
- information about where the data were collected from.
- the existence of automated decision-making, such as ‘profiling’.
- and the safeguards in place if the personal data are transferred to a third country or international organisation.
In many cases, controllers will already be providing this information to data subjects, such as through their privacy notice which is often displayed on their websites.
The following link should answer some of the most frequently asked questions by individuals who are seeking copies of their personal data. Data Subject Access Requests FAQ – Full Guidance Note
NB – This is a guide for information purposes only and does not constitute legal advice. If you have an issue requiring legal advice, please contact any of the team at Nolan Farrell & Goff LLP, whose numbers can be found on our website www.nfg.ie, or email info@nfg.ie.
