Spurred by a discussion on academia.se: suppose prof. X writes a letter of recommendation for her student mr. Y, and sends it to university Z through an on-line system. Then, the student mr. Y writes an official letter to university Z asking to see all the personal data stored about him. University Z is in Europe, so GDPR applies.

The letter contains some of mr. Y's personal data (his full name, for instance). On the other hand, the letter is a text written by prof. X, and she retains full copyright over it and can prevent further redistribution.

What should University Z do in this case? Do they have an obligation to show the recommendation letter to the student? Is there a solution that does not infringe anyone's rights?


It just happens that EU copyright law lets University Z use a photocopier to produce a paper copy of the letter for non-commercial purposees and give that copy to student Y (there are explicit exemption in EU copyright law for using a photocopy-machine for such uses).

So the conflict between the GDPR and Copyright law implied in the question does not exist. If it follows from GDPR that student Y has right to access this personal data (this may not always be the case), university Z must give student Y access to the letter (perhaps after redacting personal-data about other data subjects if such redacting is required by the GDPR).

No-one's rights are infringed by this.


The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

Article 15 GDPR

Assuming that revealing the information would be a clear copyright breach (which is by no means certain), it is not permitted.

  • @FreeRadical I agree (hence the parenthetical note), however, there are different circumstances (e.g. a publishing house with a biographical manuscript) where it may. – Dale M May 30 '18 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.