The European Data Protection Board (EDPB) has adopted new guidelines on the right of access. These (English-language) guidelines help organizations properly handle the access requests they receive.
The right of inspection is found in Article 15 of the General Data Protection Regulation (AVG). It means that data subjects have the right to request and receive access to all data that an organization processes about them. In other words, under Article 15 AVG, everyone has the right to know from an organization "what you know about me.
The right of inspection enables data subjects to check whether organizations are processing the right data. And whether they are processing that data lawfully (according to the rules of the AVG).
If this turns out not to be the case, those affected can take further steps. Such as asking for rectification or removal of their data. Or file a complaint with the privacy regulator (in the Netherlands this is the Autoriteit Persoonsgegevens).
In practice, data subjects often exercise their right of inspection. The AVG guidelines on the right of access are therefore relevant to the daily practice of many organizations in the Netherlands.
The AVG guidelines answer important practical and legal questions. And give organizations guidance on how they can and should deal with access requests.
The guidelines answer the following questions, among others:
In what ways can an organization provide access?
Does a data subject have the right to see original documents?
To what extent may an organization ask for a copy of an ID to verify the individual's identity?
In what cases may an organization deny a request for access? Or charge a fee for doing so?
The AVG guidelines on the right of access are not yet final. In fact, there is first a 6-week period for public consultation.
Anyone (both organizations and individuals) can submit a view on the guidelines. This can be done until March 11, 2022.
Based on the views received, the EDPB will hold the guidelines up to the light once more and may make further adjustments to them at points. Only then will the EDPB finalize the AVG guidelines on the right of access.
