Suppose X is a student body that holds a database of comments made by its members about the lecturers of ABC University. Professor Y from ABC requests X to send him a copy of all comments about him. Should X comply, and if so, how?

Additionally, Suppose there is a comment that says "Y is the worst lecturer in ABC University".

Suppose the head of the History Department requests X for comments on all the lecturers of the History Department at ABC University, should he comply?

My understanding is he doesn't need to comply in any of the three cases as other data users, i.e respective members who posted the comment controls the use of the data. Would that be right?

  • Is this database private or more like a public forum? Commented Mar 29, 2019 at 14:25
  • @StefanoPalazzo Private. Commented Mar 29, 2019 at 15:09

1 Answer 1


Art. 15(4) GDPR says:

(4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this.

In addition, Art. 85 GDPR requires member states to:

[...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...]

So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database).

The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail.

In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .