Since 2018, the GDPR has provided data subjects with an access right vis-a-vis the controller, including a right to copy of their data, and to be aware of and verify the lawfulness of its processing. Compliance with these requests can be burdensome for organizations, especially as the right is commonly used in labor proceedings to gain access to otherwise unavailable evidence, or simply to build pressure in settlement negotiations. The article reminds readers of the legislator’s intent when drafting the access right, encourages organizations to resist access requests made for purposes other than controlling the processing of the data subject’s data, and invites German courts and regulators to shape the contours of the right in the near future.

To view this article, click here.