A local Munich court has interpreted the right of access under Article 15 of GDPR and German law. Here are some key takeaways for GDPR and for consumer access requests under CCPA:
- The right of access under GDPR is a comprehensive right concerning the stored or processed personal data.
- It includes all data, such as name or date of birth, as well as any characteristics that can make a person identifiable, eg health data, account number, etc.
- It does not include the business’ internal actions, such as endorsements, any changes in correspondence, information the person concerned is already knows, legal reviews or analyzes. (A view not necessarily supported by GDPR.)
- No specific form is required for the information. While there is an obligation to produce copies of the information, this may not be required if the relevant content is produced otherwise.
- In certain cases, disproportionate effort for the business in producing the information may be an exception to the requirement to produce information.
- Unfairness may also be an exception to the right of access.