GDPR Recital 15 states that

Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation.

I have found an interpretation that claims

This recital seems to imply that unstructured data is not covered under GDPR, and hence is not subject to access requests. This would mean that any unstructured data should not be included in a data subject access request.

Is this a reasonable conclusion for unstructured data such as message bodies in email archives?

  • 1
    The earlier portion of 15 suggests that it is about electronic files vs paper files.
    – Paul
    May 7 '18 at 19:35

No, in my opinion, Recital 15 GDPR does not support the conclusion that unstructured electronic data, such as email message bodies, would be exempted from GDPR.

As indicated in the comments, the last sentence in Recital 15 refers to physical files or sets of files. This follows from the wording ("files or sets of files" and the reference to "cover pages") and is clear when looking at the translations (the german version refers to "Akten oder Aktensammlungen" and the french to "Les dossiers ou ensembles de dossiers").

This interpretation is further supported by Article 2(1) GDPR which separates between "processing of personal data wholly or partly by automated means" and "processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system".

This means that, generally, electronically processed personal data is covered by the GDPR (irrespective of whether the processing is structured or not), and personal data in physical papers or files is only covered by the GDPR if it is structured (or intended to be structured).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.