Bob makes a data protection request to a data controller who tells him that they are unable to comply with it and that he should therefore have his solicitors or insurers contact them. Do these types of entities have special privileges when it comes to data protection laws?

  • Not under GDPR, no. But your scenario sounds like there might be non-GDPR issues at play, e.g. negotiating a settlement.
    – amon
    Dec 17, 2023 at 18:00

1 Answer 1



The only party with a right to do this is the "data subject". They can probably delegate that via a POA as most other legal matters, but whoever gets designated as the agent has no more rights than the original data subject.

Their answer citing a solicitor or insurance strongly suggest there is missing context here and that data is probably part of some ongoing investigation or claims process. The missing context will be the explanation why the entity could not comply with the request.

  • Wouldn't the data controller be obliged to tell the data subject why they can't comply? Why would they be able to deal with the data subject's lawyer or insurer but not directly with the data subject?
    – phoog
    Dec 18, 2023 at 11:27
  • 1
    @phoog I assume that we are missing a lot of context here and the person is already in a legal battle via their insurer or lawyer and the entity does not want to complicate that or is not allowed to dodge or avoid that avenue for some reason. In some juristictions for example you can demand to only be contacted through your lawyer... so they may want to channel all communication through the lawyer to avoid to look like they circumvent that. Customer service agents might be advised to not to talk to that individual directly. Or any other reason really, we don't know.
    – nvoigt
    Dec 18, 2023 at 12:02
  • No, the data controller are not aware of any lawyer nor insurers involved, and indeed Bob has never instructed either. Dec 18, 2023 at 13:34
  • @Seekinganswers Can you explain what kind of institution this is? I have a hard time imagining any private company asking for solicitor or insurance. That does not make any sense. Which insurance? My dogs health insurance? Certainly not...
    – nvoigt
    Dec 18, 2023 at 13:55
  • 1
    Seems fair. This is the context you left out and which helps makes sense of it: You aren't requesting information on you in that case, you are requesting information on others. That is not within your GDPR rights. It is up to the authorities, maybe lawyers and maybe insurances if they are involved. Who exactly can inquire about this is up to your juristiction, but it is not a GDPR request and they correctly denied it.
    – nvoigt
    Dec 18, 2023 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .