Cybersecurity Policy Report, Irish DPC Outlines Handling of GDPR Right of Access Issues, (Mar 7, 2025)

By Tony Foley

The Irish Data Protection Commission (DPC) has issued advice for organizations on their obligation to fulfill data access requests under article 15 of the European Union’s General Data Protection Regulation (GDPR).

In a blog post published today, the DPC reminded organizations that under article 15(1), individuals are entitled to obtain information from an organization concerning the purpose for which personal data is being processed, categories of personal data involved, the recipients or categories of recipients to whom the personal data has been or will be disclosed, and where possible, how long the personal data will be stored.

The post noted that organizations might be entitled to restrict the release of personal data if they relied on provisions of the GDPR or the Irish Data Protection Act 2018. For example, in a case where records contain both the personal data of the requesting individual and of other persons, article 15(4) permits organizations to withhold such information if disclosure could adversely affect the other person or persons involved. When considering the potential application of this restriction, an organization should be able to demonstrate and have recorded the reasoning behind why it considers the restriction to be applicable, as well as providing details on how the decision was reached and the efforts made to consider the rights of all concerned. The DPC also pointed out that section 60(3)(b) of the Data Protection Act also might entitle an organization to withhold information from an individual to the extent that the information constituted an expression of opinion about the individual given in confidence.

The DPC said it regularly handled complaints about organizations over failures to address data access requests and said it generally examined any restrictions relied on by an organization to limit access so that it could assess whether they had been correctly applied. The DPC will contact the organization and pose certain investigative questions to assist the agency in determining the validity of the restrictions applied, it said.

The post concludes by specifying that a restriction to the right of access must be justified by evidence and by reference to the specific context of the case. An identified risk of harm to a third party arising from the potential disclosure of personal data to the requesting individual could justify withholding of the information, and in highly sensitive situations where release of personal data is highly likely to result in significant harms and risks to other persons, a general presumption may be made that the right of access can be restricted.

News: InternationalLegislation DataPrivacy GDPR