Spurred by a discussion on academia.se: suppose prof. X writes a letter of recommendation for her student mr. Y, and sends it to university Z through an on-line system. Then, the student mr. Y writes an official letter to university Z asking to see all the personal data stored about him. University Z is in Europe, so GDPR applies.

The letter contains some of mr. Y's personal data (his full name, for instance). On the other hand, the letter is a text written by prof. X, and she retains full copyright over it and can prevent further redistribution.

What should University Z do in this case? Do they have an obligation to show the recommendation letter to the student? Is there a solution that does not infringe anyone's rights?

2 Answers 2


It just happens that EU copyright law lets University Z use a photocopier to produce a paper copy of the letter for non-commercial purposees and give that copy to student Y (there are explicit exemption in EU copyright law for using a photocopy-machine for such uses).

So the conflict between the GDPR and Copyright law implied in the question does not exist. If it follows from GDPR that student Y has right to access this personal data (this may not always be the case), university Z must give student Y access to the letter (perhaps after redacting personal-data about other data subjects if such redacting is required by the GDPR).

No-one's rights are infringed by this.


The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

Article 15 GDPR

Assuming that revealing the information would be a clear copyright breach (which is by no means certain), it is not permitted.

  • @FreeRadical I agree (hence the parenthetical note), however, there are different circumstances (e.g. a publishing house with a biographical manuscript) where it may.
    – Dale M
    May 30, 2018 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .