A controller cites ‘trade secrets’ as a reason to refuse an entire access request without any balancing analysis. What is the correct approach?
Select an answer to reveal the explanation.
Short Explanation
Trade secrets are a shield for some sensitive bits—not a blanket that covers the whole house. You still owe the person their personal data story, trimmed only where a real balancing exercise says disclosure would hurt others’ rights. ‘Trade secrets’ as a total veto without analysis is too blunt.
Full Explanation
Trade secrets and intellectual property may justify limiting disclosure of some information in an access response, but they do not wipe out the right of access wholesale without careful balancing. Controllers should disclose the requester’s personal data and required information to the greatest extent possible, redacting or abstracting truly secret elements rather than issuing a total refusal based on a “trade secrets” label alone.
Trade secrets do not always extinguish access for every record held. Access also need not always include full verbatim disclosure of third-party proprietary algorithms; meaningful information about logic may suffice where Article 15/22 themes apply. Internal “confidential” stamps on documents do not by themselves authorise blanket refusal of access rights.
Exam caveat: IP/trade-secret limits are surgical, not a kill switch for Article 15. Operational check: segregate personal data from proprietary code, provide personal data and high-level logic explanations, document specific withholdings, and involve legal review for contested algorithm cases. Public and private controllers serving residents should avoid using secrecy jargon to stonewall basic access to a person’s own data, recording why total refusal failed the balancing test.