The search efforts businesses must make to meet data subject access requests (SARS) made under EU data protection law cannot be limited by what they consider to be proportionate, the European Data Protection Board (EDPB) has said.
Confirmation that businesses cannot apply a proportionality test to their searches for personal data in response to SARS was outlined by the EDPB in draft new guidelines the authority is consulting on in relation to the right of access. The draft guidance is open to consultation until 11 March 2022.
The right of access is one of the several rights data subjects enjoy under the EU General Data Protection Regulation (GDPR). It provides them with rights to obtain a copy of their personal data that organisations hold about them. The GDPR stipulates that organisations must respond to SARs "without undue delay and at the latest within one month" unless extensions can be justified and sets out further requirements in relation to the information that must be provided in response.
The right of access is not absolute – organisations can refuse or limit their response to SARs in some circumstances where exemptions may apply. The EDPB’s draft guidelines address those scenarios in more detail.
The EDPB confirmed that limits in how organisations respond to SARs can apply where the rights and freedoms of others are triggered or where the request made is “manifestly unfounded or excessive”. It also cited other restrictions that might apply, such as where...
A man in his 40s who raised allegations of overseas sexual misconduct involving Democratic Party of Korea candidate Park Ji-won ahead of the June 3 local elections has been referred to the Prosecu...