Balancing GDPR Data Access Rights Against The Rights Of Others

One of the most common challenges faced by controllers, and consistently the most complained about topic to the Data Protection Commission ("DPC"), is the right of access. Controllers are often frustrated about the broad scope of the right of access, the expansive definition of personal data and the seemingly boundless resources expected to be deployed in responding to these requests. Until recently there has been relatively little guidance available to controllers as to how they can balance the right of access with other often competing rights, which can include the rights of third parties to privacy, confidentiality, security and safety.

Article 15(3) GDPR provides a right to individual data subjects to obtain a copy of their personal data from any controller that processes it. Article 15(4) GDPR limits the scope of a data subject access request ("DSAR") in circumstances where this would "adversely affect the rights and freedoms of others". While Article 15(4) is