The European Data Protection Board (EDPB) has embarked on a significant initiative aimed at reinforcing the right of access, a fundamental aspect of data protection. Launched on February 28, 2024, this initiative involves 31 Data Protection Authorities (DPAs) across the European Economic Area (EEA), including 7 German State-level DPAs, focusing on how organizations implement individuals’ right to access their personal data.
The right of access is pivotal within data protection legislation. It allows individuals to verify the accuracy and legality of how their personal data is processed, potentially enabling the exercise of other data protection rights, such as rectification and erasure. The importance of this right cannot be overstated, as it lies at the heart of data protection, reflecting its frequent exercise and the numerous complaints DPAs receive about its implementation.
Recognizing its critical role, the EDPB chose the right of access for its third Coordinated Enforcement Framework (CEF) action during its October 2023 plenary. This decision underscores the Board’s commitment to ensuring that individuals can effectively exercise their data protection rights.
In preparation for this initiative, the EDPB adopted Guidelines on data subject rights – Right of access in 2023. These guidelines are designed to help organizations comply with the GDPR’s requirements when responding to data access requests from individuals. They also aim to ensure that requests for access to personal data are handled appropriately, respecting the individual’s rights and the organization’s legal obligations.
The enforcement of the right of access will be carried out through a multi-faceted approach:
- Distributing questionnaires to organizations for fact-finding purposes or to determine the need for a formal investigation.
- Initiating formal investigations where necessary.
- Following up on ongoing formal investigations.
The data that is collected from those actions will lead to determining the supervision and enforcement strategies of DPAs. Such joint work is expected to provide a comprehensive overview of the extent of compliance of the right of access, which will be beneficial for the targeted interventions at the EU level. As its complementary action, the EDPB is going to make up a study that will outline the final results of this coordinated approach, demonstrating its high efficiency.
