How far does the right to access under the GDPR reach?

12 Jun 2019

On 23 May 2019, the court of Noord-Holland rendered an interesting ruling on the right to access under the GDPR.

Philip Nabben

The GDPR explicitly refers to a right to a copy of the personal data, a term that ended up in the GDPR during its creation process and that had not been explicitly mentioned in the old legislation (Directive and Privacy Act). The Court of Noord-Holland, however, ruled that this does not mean that a data subject actually receives copies of all documents in which the personal data have been processed. According to the court, there is a right to full access, in comprehensible form, of all personal data, in such a manner that it enables the data subject concerned to take cognizance of his data and to check it. And to the extent that this can be satisfied with a form of provision other than the provision of actual copies, the GDPR conditions are is thus met, according to the court.

Employment law practice shows that requests for copies of personal data are usually met by the provision of actual copies (with the exception of certain internal notes that are exclusively intended for internal consultation, for more details see our 2017 article.  According to this court, however, this is not strictly necessary. Only if certain forms of personal data are difficult to include in an overview, a data subject is actually entitled to a copy of the documents containing those data, simply because that is the most effective way to comply with the request for access. From an employment law aspect , an end-of-year assessment would be an example of such a document.

One could argue that this discussion is perhaps somewhat theoretical, since a request for access/inspection will often be made, precisely for the purpose of obtaining (copies of) year-end assessments and the like. Nevertheless, it is good to know that the right of copy, based on the ruling of the Noord-Holland District Court, does not automatically mean that the person concerned may demand copies of all documents in which the personal data are included.