A resident emails a city portal: 'Send me everything you have on me.' Which response best reflects the GDPR right of access?
Select an answer to reveal the explanation.
Short Explanation
When someone asks 'what do you have on me?', that's the access right knocking. Verify who's asking, then share their data and the main processing story—not a shrug or a 'sue us first.' Limits exist, but silence isn't the default.
Full Explanation
The right of access entitles a data subject to obtain their personal data and key information about the processing, after appropriate identity verification and subject to recognised limits such as protecting others’ rights and freedoms. A resident email to a city portal asking to “send me everything you have on me” is a classic Article 15 request and should enter the rights workflow promptly rather than being ignored as informal.
Portal emails can be a valid channel unless the controller has clearly communicated an accessible alternative and does not use channel formalism to obstruct rights. Replying with only a blank template privacy notice fails to disclose the requester’s personal data. Requiring the resident to sue in national court before any access is considered invents a barrier the GDPR does not impose as a precondition.
Exam caveat: verify identity proportionately, then search thoroughly within the one-month timing rule (with limited, notified extensions). Operational check: log the request, verify identity, retrieve personal data across systems, apply necessary third-party redactions, and respond with both data and required Article 15 information elements. Civic portals should make access a workable citizen service—not a dead mailbox—and record why “ignore email” and “sue first” options fail public-service standards.