A controller refuses a subject access request in full by citing a police-investigation exception, without checking whether Member State law actually authorises that restriction or whether a narrower response is possible. What is the sound GDPR approach?
Select an answer to reveal the explanation.
Short Explanation
Think of rights restrictions like a lock on a filing cabinet that only the statute can turn. You cannot invent a police exception out of thin air or slam the door on the whole request without reading the law. Check the legal basis for the restriction and narrow it to what is actually needed.
Full Explanation
Restrictions on data-subject rights are exceptions, not a default posture. When a controller refuses a subject access request in full by citing a police-investigation exception, it must verify that GDPR and applicable Member State law actually authorise that restriction and apply it only to the extent necessary. A blanket refusal without legal analysis and without considering a narrower response—such as partial disclosure with redactions—fails the proportionality expected of restrictions.
Refusing every access request that merely mentions law enforcement over-blocks rights and may lack a statutory footing. Granting full access immediately on the theory that investigation exceptions never apply to private controllers ignores that Member State law can, in defined cases, restrict rights for private controllers too—but that still demands analysis, not slogans. Converting an access request into an erasure request does not make investigation concerns “irrelevant” and misuses a different right.
Exam caveat: restrictions are lawful only where the GDPR plus Member State law allow, and only as far as necessary. Operational check: identify the exact national provision relied upon, document necessity and scope, prefer partial fulfilment where possible, and seek legal review for high-risk investigation contexts. Civic and regulated organisations should protect ongoing investigations without casually extinguishing residents’ access rights, recording why a total shut-door approach was rejected.