Karl the data controller writes to Adam their data subject, declaring that they have received “multiple complaints” about his behaviour from unnamed fellow data subjects, including of threatening to stab his peers with machetes, spraying whipped cream over their desks, and blaring the third reich’s national anthem from 5 foot tall speakers, none of which Adam has any recollection of doing, much less being directly accused of. Adam submits a SUBJECT ACCESS Request to Karl, seeking access to copies the complaints that Karl may have received about him. This accords with the aim of the GDPR’s right of access, which includes the right to review personal information held by third parties in order to ensure it is all up to date and accurate. (In this case, Adam has serious concerns that much or all of it is actually wildly inaccurate.)
Karl would like to treat the complainants with sensitivity and discretion because apparently the complainants would prefer to cowardly make false accusations about Bob where they may cause him much hassle if not ultimately serious consequences, but not to be accountable to these so that they may only be refuted in the form of inevitably unfaithful so-called “Chinese whispers,“ or perhaps rather Karl simply assumes that they would.
In any event, Karl expects Adam to face and answer the form of the accusations that Karl best recalls from his letters from the complainants rather than letting Bob see the full original content of the complaints much less disclose the complainants’ identity, even though - if the complaints had been true, then presumably - Adam would already know who they were.
Does the right of access apply to the complaints and related materials/discussions, whether with the complainants identities redacted or not?