Summary Final Decision Art 60
Complaint
No infringement of the GDPR
Background information
Date of final decision: 12 September 2019
LSA: DE-Hessen
CSAs: CY, DK, ES, FR, SE
Legal Reference: Right of Access (Article 15), Exercise of Data Subject Rights (Article 12)
Decision: No infringement of the GDPR
Key words: Right of access, Exercise of data subject rights
Summary of the Decision
Origin of the case
The complainant alleged that he did not receive a response to his request to access a copy of his personal data, processed by the controller, within the one-month timeframe set by the GDPR.
Findings
The LSA found that at the time of the complaint, the controller was faced with an important amount of data protection related queries, justifying the need for an extension of the timeframe.
In a first reply to the request, the controller gave access only to a part of the personal data requested. The complainant reiterated the request for the remaining personal data. A second reply was sent to the complainant, which the complainant never received. Once the complaint was made to the LSA, the controller sent the letter again, which the complainant received this time. The controller also improved their internal processes for future responses to such requests.
Decision
No infringement of the GDPR was found, since appropriate action had been undertaken by the controller.
—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_de_hessen_2019-09_right_of_access_summarypublic.pdf
Please see also EDPB Copyright page