Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to stab his peers with machetes, spraying whipped cream over their desks, and blaring the third reich’s national anthem from 5 foot tall speakers, none of which Adam has any recollection of doing, much less being directly accused of. Adam submits a SUBJECT ACCESS Request to Karl, seeking access to copies the complaints that Karl may have received about him. This accords with the aim of the GDPR’s right of access, which includes the right to review personal information held by third parties in order to ensure it is all up to date and accurate. (In this case, Adam has serious concerns that much or all of it is actually wildly inaccurate.)

Karl would like to treat the complainants with sensitivity and discretion because apparently the complainants would prefer to cowardly make false accusations about Bob where they may cause him much hassle if not ultimately serious consequences, but not to be accountable to these so that they may only be refuted in the form of inevitably unfaithful so-called “Chinese whispers,“ or perhaps rather Karl simply assumes that they would.

In any event, Karl expects Adam to face and answer the form of the accusations that Karl best recalls from his letters from the complainants rather than letting Bob see the full original content of the complaints much less disclose the complainants’ identity, even though - if the complaints had been true, then presumably - Adam would already know who they were.

Does the right of access apply to the complaints and related materials/discussions, whether with the complainants identities redacted or not?

1 Answer 1



In the first place, that “right” applies when you go to court and it isn’t the right to know them, it’s a right “to examine or have examined witnesses against him…”. And, in certain circumstances, the rights of the witness to be safe (e.g. in organised crime trials), overrides the right of the defendant.

With respect to a subject access request under the GDPR, there is an exemption if the data contains information about other individuals.

If you have the consent of the other person it’s unreasonable not to disclose the data. If you don’t have their consent, you have to weigh the rights of both individuals and decide if it is reasonable to comply with the SAR in the circumstances.

If you decide not to comply, you must inform the requester:

  • The reasons for your decision
  • That they can complain to the ICO
  • Of their right to challenge the decision in court.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .