The countdown to commencement of the GDPR is on. While guidance
will continue to emerge on many of the newer topics addressed in
the GDPR, there is already a wealth of caselaw and guidance on the
topic of data subject access rights ('DSARs'). So, what are
the rules and how are they changing?
Background
Article 12 of Directive 95/46/EC (the 'Directive')
requires Member States to ensure that data subjects have a legal
right of access to their personal data. The principle behind this
right is to allow a data subject to review their personal data kept
by a data controller to ensure its compliance with the Directive,
thereby encouraging controllers to adopt good data protection
practices. In Ireland, a controller currently has 40 days to
respond to a DSAR, which need not be in any particular form other
than 'in writing'. A modest fee (€6.35) can be
applied.
