Spurred by a discussion on academia.se: suppose prof. X writes a letter of recommendation for her student mr. Y, and sends it to university Z through an on-line system. Then, the student mr. Y writes an official letter to university Z asking to see all the personal data stored about him. University Z is in Europe, so GDPR applies.
The letter contains some of mr. Y's personal data (his full name, for instance). On the other hand, the letter is a text written by prof. X, and she retains full copyright over it and can prevent further redistribution.
What should University Z do in this case? Do they have an obligation to show the recommendation letter to the student? Is there a solution that does not infringe anyone's rights?