A city receives an access request and redacts other residents’ personal data from the response before disclosing the requester’s information. Why is that approach appropriate?
Select an answer to reveal the explanation.
Short Explanation
Your access right is about your data—not a backstage pass to the whole neighbourhood. Black out the other residents’ details, then hand over what is yours. That is how you honour access without steamrolling everyone else.
Full Explanation
Access must not adversely affect the rights and freedoms of others. When a city redacts other residents’ personal data from an access response before disclosing the requester’s information, it correctly balances Article 15 with third-party protection. The requester still receives their own personal data and the required information elements; neighbours are not turned into collateral disclosure victims of someone else’s access right.
Cities can be—and often are—controllers and routinely must answer access requests; “cities are never controllers” is false. Redaction is not forbidden; disclosing every neighbouring resident’s data in full would create new confidentiality breaches. Article 15 is not limited to anonymised city statistics; individual access to one’s own personal data remains central to the right.
Exam caveat: third-party redaction is a feature of compliant access, not a violation of it. Operational check: identity-check the requester, extract their data across systems, systematically redact others’ identifiers, quality-assure the pack, and meet the one-month timing rule. Municipal records often intertwine residents’ lives in case files and correspondence; careful redaction is how civic transparency to one person avoids harming another, and teams should document why unfiltered multi-resident dumps were rejected.