A controller publishes a policy stating that every data-subject rights request costs €200 with no exceptions. How should that fee policy be assessed under the GDPR?
Select an answer to reveal the explanation.
Short Explanation
Think of rights requests like asking for your own receipts—usually you should not get hit with a fixed €200 cover charge. The GDPR keeps these free by default and only lets controllers charge (or refuse) when a request is clearly abusive or repetitive. A blanket always-€200 policy misses that rule.
Full Explanation
Articles 12 and related rights provisions establish that responses to data-subject requests are generally provided free of charge. Controllers may charge a reasonable fee or refuse to act where requests are manifestly unfounded or excessive, particularly because of their repetitive character. A published policy imposing a fixed €200 fee on every request therefore conflicts with the free-of-charge baseline and the limited fee exceptions.