A controller publishes a policy stating that every data-subject rights request costs €200 with no exceptions. How should that fee policy be assessed under the GDPR?
Select an answer to reveal the explanation.
Short Explanation
Think of rights requests like asking for your own receipts—usually you should not get hit with a fixed €200 cover charge. The GDPR keeps these free by default and only lets controllers charge (or refuse) when a request is clearly abusive or repetitive. A blanket always-€200 policy misses that rule.
Full Explanation
Data-subject rights requests are generally free of charge. A controller may charge a reasonable fee or refuse to act only where requests are manifestly unfounded or excessive—for example, repetitive requests—based on administrative costs of providing information or communication or taking the action requested. A blanket policy that every rights request costs €200 with no exceptions converts a statutory free-of-charge baseline into an unlawful toll booth and chills exercise of rights.
Controllers may not set any flat fee they choose for every rights request as a default cost-recovery model. Rights requests are not free only when the controller has fewer than fifty employees; headcount is not the free-of-charge switch. A €200 fee is not mandatory whenever special-category data appear; sensitivity may affect handling care, not a compulsory surcharge on the right itself.
Exam caveat: free by default; fee or refusal only for manifestly unfounded or excessive cases—and that determination must be defensible. Operational check: publish how to exercise rights without payment barriers, define narrow criteria for excessiveness, document any fee decisions, and train front-line staff not to demand payment up front. Civic bodies especially should treat access and related rights as public entitlements, recording why a universal €200 gate was rejected as incompatible with accountable administration.