When fulfilling a subject access request, a controller ignores guidance on scope and dumps every system log, including third-party trade secrets and other people’s personal data, without any balancing. What should the controller do instead?
Select an answer to reveal the explanation.
Short Explanation
Access is not a dump-everything free-for-all. Picture handing someone their folder while covering coworkers’ sticky notes and vendor secrets. Follow the guidance: give the person their data, and protect everyone else’s rights where those collide.
Full Explanation
Article 15 access responses should give the data subject meaningful information about their personal data. EDPB guidance emphasises careful scoping and that access must not adversely affect the rights and freedoms of others, including third-party personal data and confidential information. Indiscriminate full-log dumps without balancing undermine that duty.