Coordinated Enforcement Action: EDPS findings highlight challenges on right of access to personal data

The European Data Protection Supervisor (EDPS) has released today its findings on the enforcement of individuals’ right of access to their personal data when processed by EU institutions, bodies, offices, and agencies (EUIs). These findings are part of the European Data Protection Board’s (EDPB) broader Coordinated Enforcement Action initiated in The EDPB report aggregates the findings of the participating Data Protection Authorities, including the EDPS.

Through its dedicated efforts, the EDPS conducted a detailed survey among EUIs and analysed complaints related to individuals’ access requests. The results underline both the successes and the challenges faced by EUIs in ensuring individuals can exercise their right of access to their personal data as outlined in Regulation (EU) 2018/1725.

Wojciech Wiewiórowski, EDPS, said: “The right of access is one of the core elements of data protection, it is a vehicle for transparency and accountability on how individuals’ personal data is processed by EUIs and whether this is done in compliance with Regulation (EU) 2018/1725. The report and this exercise underscore the EDPS’ commitment to upholding data protection standards within EU institutions and to ensuring that individuals’ rights are respected in practice.”

In summary, the EDPS highlights the following five key findings.

• A limited volume of requests:

Most EUIs receive between 0 and 25 access requests annually, with 58 out of 63 respondents reporting this figure for 2023. This might be partly be due to the existence of self-service tools enabling individuals, especially EUIs’ staff members, to download their personal data themselves.

• A decentralised way of handling data:

Many EUIs lack centralised systems for managing access requests, leading to potential inconsistencies and difficulties in demonstrating compliance during audits or litigation.

• Challenges in categorising requests:

EUIs face obstacles in distinguishing access requests from other types of requests, such as public access to documents or complaints.

• Identity verification issues:

Verifying the identity of requesters sometimes results in excessive or unnecessary processing of personal data, including sensitive data.

• Interpretation of obligations:

Practical challenges arise in providing copies of personal data while balancing this obligation with protecting the rights and freedoms of others.

The EDPS findings will shape future supervisory and enforcement actions, aiming to improve how EUIs address individuals’ right of access.