When fulfilling a subject access request, a controller ignores guidance on scope and dumps every system log, including third-party trade secrets and other people’s personal data, without any balancing. What should the controller do instead?
Select an answer to reveal the explanation.
Short Explanation
Access is not a dump-everything free-for-all. Picture handing someone their folder while covering coworkers’ sticky notes and vendor secrets. Follow the guidance: give the person their data, and protect everyone else’s rights where those collide.
Full Explanation
Article 15 access must be fulfilled in a manner informed by practical guidance, including EDPB themes: disclose the requester’s personal data and required information while balancing and protecting the rights and freedoms of others. Dumping every system log—including third-party trade secrets and other people’s personal data—without balancing is not compliant transparency; it can create new infringements.
Providing no access at all whenever third-party data appear in the same systems is an over-refusal; controllers should redact or separate others’ data and still honour the requester’s access where feasible. Always disclosing every raw log line because “Article 15 forbids any redaction” misstates the balance with others’ rights. Publishing the full dump publicly replaces individual access with mass disclosure and is not a lawful substitute.
Exam caveat: access is individualised disclosure with balancing—not a data firehose and not a total blackout. Operational check: define search scope, apply third-party and privilege redactions, quality-check extracts, and explain any withholdings at a high level where appropriate. Municipal responders should give the resident their own picture of processing without dumping neighbours’ data onto the street, documenting why unfiltered log exports were rejected.