3

The GDPR guidance states that subject access requests can only be refused if they are manifestly unfounded or excessive.

The detailed guidance on what constitutes manifestly unfounded or excessive can be found here

In summary a manifestly unfounded or excessive request is:

  • Malicious or intends to cause disruption

  • Repeats previous subject access requests

  • Overlaps with other subject access requests

The guidance makes no mention about whether or not it would be excessive to request information clearly already known to the subject.

When I say information already known, I mean for example:

Asking a previous employer for information such as:

  • My salary while I worked there

  • My start and leaving date

  • My job title

This would be useful in a situation for example, where a person needs to prove their income for the last several months and the previous employer is refusing to provide an employers letter.

Of particular interest is the following paragraph:

An individual may also want to receive another copy of information they have requested previously. In this situation a controller can charge a reasonable fee for the administrative costs of providing this information again and it is unlikely that this is an excessive request.

This seems to imply that I can ask an organization for another copy of information that I already know. They can charge a fee, but not refuse to comply.

4
  • Even if the employer is required to provide it, I'm not sure that it helps you. If they want to be difficult, they could provide it in some form that is useless for the desired purpose. For instance, they could send you your income scrawled on a plain piece of paper (not letterhead) with no signature or other proof that it isn't something you wrote by yourself. – Nate Eldredge Nov 18 '20 at 1:56
  • @NateEldredge then they haven’t complied with the request. Their response must be useful to comply with GDPR. – Dale M Nov 18 '20 at 2:04
  • If I proved to them that it is required then I don't think they'd be spiteful. They're just trying to avoid doing it because it's a nuisance. – Karl Nov 18 '20 at 2:09
  • A Subject Access Request is intended to inform you about the information a given entity holds about you - even if you should already know that information through previous interaction or channels. – Moo Nov 18 '20 at 3:39
3

A data subject access request can be valid even if it wouldn't disclose new information. The right to access ties in with the GDPR's transparency principle (finding out which data is being processed) and with the right to rectification (are there any mistakes in the data being processed?). For rectification, it's pretty much ideal if you get back exactly the data you expect – but you're allowed to check with an access request.

The Art 12(5) limitations on excessive or manifestly unfounded requests do put a limit on the right to access, but this limit helps controllers respond to legitimate requests. For example, if a request is clearly intended to harass the controller with busywork, it can be denied as unfounded. Similarly, requesting access to the same data very frequently would be excessive. However, the controller has burden of proof to show that the request is excessive or unfounded – basically impossible for a one-time request for specific data. A request is not automatically excessive just because it is likely to only return data you already know. But ultimately, detailed guidance on the interpretation of “excessive” is up to the supervisory authorities – the GDPR itself provides no guidance.

Aside from the above exception, access can only be denied if it would adversely affect the rights and freedoms of others. For example, you could be denied access to non-anonymous performance reviews. There would be no such adverse effect for basic information about your employment.

If a data controller improperly considers your request as excessive or unfounded, you can lodge a complaint with your supervisory authority, e.g. the ICO in the UK. Most controllers are suddenly extremely helpful once contacted about an official complaint.

1
  • 1
    Yes, the point about transparency and right to rectification makes it very clear. Using that logic I can even make a subject access request for something like my own name, which I clearly already know but might want to check it's spelled correctly in their records. – Karl Nov 18 '20 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.