GDPR: Can I make a subject access request for information that I obviously already know?

Question

The GDPR guidance states that subject access requests can only be refused if they are manifestly unfounded or excessive.

The detailed guidance on what constitutes manifestly unfounded or excessive can be found here

In summary a manifestly unfounded or excessive request is:

• Malicious or intends to cause disruption

• Repeats previous subject access requests

• Overlaps with other subject access requests

The guidance makes no mention about whether or not it would be excessive to request information clearly already known to the subject.

When I say information already known, I mean for example:

Asking a previous employer for information such as:

• My salary while I worked there

• My start and leaving date

• My job title

This would be useful in a situation for example, where a person needs to prove their income for the last several months and the previous employer is refusing to provide an employers letter.

Of particular interest is the following paragraph:

An individual may also want to receive another copy of information they have requested previously. In this situation a controller can charge a reasonable fee for the administrative costs of providing this information again and it is unlikely that this is an excessive request.

This seems to imply that I can ask an organization for another copy of information that I already know. They can charge a fee, but not refuse to comply.

Answer 1

A data subject access request can be valid even if it wouldn't disclose new information. The right to access ties in with the GDPR's transparency principle (finding out which data is being processed) and with the right to rectification (are there any mistakes in the data being processed?). For rectification, it's pretty much ideal if you get back exactly the data you expect – but you're allowed to check with an access request.

The Art 12(5) limitations on excessive or manifestly unfounded requests do put a limit on the right to access, but this limit helps controllers respond to legitimate requests. For example, if a request is clearly intended to harass the controller with busywork, it can be denied as unfounded. Similarly, requesting access to the same data very frequently would be excessive. However, the controller has burden of proof to show that the request is excessive or unfounded – basically impossible for a one-time request for specific data. A request is not automatically excessive just because it is likely to only return data you already know. But ultimately, detailed guidance on the interpretation of “excessive” is up to the supervisory authorities – the GDPR itself provides no guidance.

Aside from the above exception, access can only be denied if it would adversely affect the rights and freedoms of others. For example, you could be denied access to non-anonymous performance reviews. There would be no such adverse effect for basic information about your employment.

If a data controller improperly considers your request as excessive or unfounded, you can lodge a complaint with your supervisory authority, e.g. the ICO in the UK. Most controllers are suddenly extremely helpful once contacted about an official complaint.