Can a Data Controller refuse a second SAR from the same person?

Question

Suppose that a business subject to the GDPR responds to an SAR (Subject Access Request) from a customer, providing video footage of the customer in the store's entry, captured by a security cam. Fulfilling this is a bit of a hassle for the store's IT department. Perhaps two months later th4e same customer makes a similar request. Can the business refuse this? How can the customer enforce his or her right to the data?

Answer 1

Article 15 of the GDPR provides that:

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data...

There is no exception for having previously provided data to the same subject.' Article 12 paragraph 1 provides:

The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language ...

Paragraph 3 of article 12 further provides that:

The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

However paragraph 5 of article 12 provides that

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b) refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

If the data controller (DC) claims that the SAR is "manifestly unfounded or excessive" it can be refused, but the DC must be able to prove that this is in fact the case, if challenged..

All these provisions can be enforced by the relevant Data Protection Authority (DPA), the national regulatory agency which handles GDPR and other data protection issues. In addition, privates suits under the GDPR are authorized under Article 82. Paragraphs 1 and 6 of that article provide:

1 Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

...

6 Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).

So a retaliatory refusal to respond to an SAR, or an unexplained refusal, could result in fines or other sanctions from the relevant DPA, or in a private suit, or both.