← back to the act's dossier

GDPR — Article 15

The article's text

Article 15 Right of access by the data subject 1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article
full text
22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. 3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. 4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Section 3 Rectification and erasure

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

38
business association
9
company
7
other
7
EU citizen
6
NGO
WhoCountryWhat they wrote
Deutsche Industrie- und Handelskammer (DIHK) / German Chamber of Commerce and IndustryDErbands- 8 DATENSCHUTZ PRAKTIKABEL GESTALTEN | IHK-UMFRAGE ZUR DSGVO | DIHK | Haben Sie Schwierigkeiten, Auskunftsrechte nach Art. 15 zu beantworten? (Nach Art. 15 DSGVO haben betroffene Personen das Recht, Auskunft darüber zu verlangen, welche ihrer Daten ↗
Asociación Española de Economía Digital (Adigital)EScan The scope of the right to information, within the meaning of Article 15 needs to be limited, or at least clarified. Companies are uncertain whether this provision would be applicable also to: (i) handwritten notes, (ii) the mere mention of the petitioner i ↗
German Insurance AssociationDEbut the data is not stored by the provider, should not be understood as recipients within the meaning of Art. 15 GDPR. • Rectification (Article 16) Members reported limited use of the right of rectification. • Erasure (Article 17) Members mainly reported limit ↗
Bitkom e.V.DEpenalties should their good-faith solutions be deemed insufficient. For quantification, we noticed an increase of Art. 15 requests after the entry into force of the GDPR in 2018 and 2019. After a decrease in 2020 – 2022 we notice an increase again in 2022, whi ↗
FEBISDEation obligations, including the type and level of detail of the information to be provided (Articles 12 to 14) • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • M ↗
EDRi European Digital RightsESt be aware of their data being processed. It is therefore puzzling that enforcement of this article is so rare. • Access to data (Article 15) A significant number of GDPR complaints center on unsuccessful access requests or requests that linger for years, enab ↗
Confederation of Swedish EnterpriseSEthe 6 (10) processing of personal data is lawful or not. Instead, it is common that e.g., a request of access (Art. 15 GDPR) is used for various strategic purposes, such as: to obtain information about a terminated employment; to gain advantages in a legal dis ↗
VAUNET Verband Privater Medien e.V.DE, dass Betroffenenrechte nicht selten entgegen ihrer Schutzrichtung in- strumentalisiert werden. Dies gilt vor allem bzgl. des in Art. 15 DSGVO geregelten Auskunftsan- spruchs. In der Praxis üben viele der von einer Datenverwendung Betroffenen das ihr zustehen ↗
ACCISBErmining role in the granting of credit. Consequently, in those instances and according to the ECJ, the consumer would enjoy under Article 15(1)(h) the right to directly obtain from the CRA ‘meaningful information about the logic involved”. 2 For example, in It ↗
EurochambresBEright to access personal data under the GDPR (Article 15) lacks clarity, allowing for broad interpretations. This ambiguity leads to misuse of data subject rights for other purposes, such as obtaining data without charge. There is a need for clearer definition ↗
European Banking FederationBEbetween local rules of civil procedure at member state level and Article 15 further (e.g., to what extent may Art. 15 “tops” traditional rules of civil procedure). The EDPB guidance on the right of access addresses this matter in a footnote. o Addressing a dat ↗
French Association of Large Companies (AFEP)FRdetail of the information to be provided (Articles 12 to 14) NA 3 GDPR evaluation – 2024 report – February 2024 • Access to data (Article 15) AFEP member companies note that the scope of the right of access is not clearly defined. Companies cannot assume by de ↗
Federation of the European Sporting Goods Industry (FESI)BEmation obligations, including the type and level of detail of the information to be provided (Articles 12 to 14) -Access to data (Article 15) -Rectification (Article 16) Erasure (Article 17) -Data portability (Article 20) -Right to object (Article 21) -Meaning ↗
European Association of Public Banks and funding agencies (EAPB)BEoverview initially and detailed information upon request or in a second step, would be a preferable solution. 2. Access to data (Article 15) Article 15 is often misused for non-data protection purposes in practice, such as in employment termination disputes d ↗
Gesellschaft für Datenschutz und Datensicherheit (GDD) e.V.DE15 Abs. 1 S. 1 lit. b) DS-GVO) sowie die „Kopie der personenbezogenen Daten“ (Art. 15 Abs. 3 S. 1 DS-GVO) geboten. Es ist in der Rechtspraxis nur schwer nachvollziehbar, wo der Unterschied in den vom Antragsteller erbetenen Auskünfte liegen soll. Gerade der Be ↗
Bundesvereinigung der Deutschen ArbeitgeberverbändeDEAuskunftsersuchen (ehemaliger) Mitarbeiter die Auskunft verweigert werden darf. Art. 15 Der Auskunftsanspruch aus Art. 15 DS-GVO wird zunehmend missbräuchlich geltend gemacht. Das bedeutet insbesondere für größere Unternehmen mit unzähligen automatisierten Dat ↗
BDI e.V. (Federation of German Industries)DEaccess. It would make practical sense to limit data requests to a certain level of detail. We recommend modifying Art. 15 in such a way that data subjects must specify their requests and restrict abuse requests in cases where there is no data protection intere ↗
BundesrechtsanwaltskammerDEtection Act (Bundesdatenschutzgesetz, BDSG) provides for the possibility of refusing to provide infor- mation in accordance with Article 15 GDPR if professional secrets must be disclosed. ↗
—FRdu RT ou de la CNIL ainsi que ses erreurs d’appréciation. Il faut faire une demande de communication de documents (ou une demande article 15 RGPD) pour récupérer, après clôture, les actes de la procédure. Cela fait une démarche chronophage supplémentaire, que ↗
Datenanfragen.de e. V.DEssible through our platform datarequests.org. For this purpose, we first and foremost offer a generator for requests according to Art. 15 et seq. GDPR, a database of controller privacy contact details, and an accompanying interface for users to manage their re ↗
ZVEI e. V. - Verband der Elektro- und DigitalindustrieDEeiner Auskunft gemäß Artikel 15 DSGVO nicht mehr aus. Hier sollten gesetzliche Anpassungen vorgenommen werden. Die EU verfolgt einen „One Size fits all-Ansatz“. Die DSGVO gilt gleichermaßen für große Konzerne, für KMU sowie für gemeinnützige Vereine, die von E ↗
European Association for the Consumption-based Billing of Energy CostsBEke practical sense to limit data requests to a certain level of detail. Ref. Ares(2024)967925 - 08/02/2024 We recommend modifying Article 15 in such a way that data subjects must limit or specify their requests and restrict abuse requests in cases where there ↗
BSA | The Software AllianceBEontroller and processor. However, several challenges persist, undermining this delicate balance: • Right to access personal data (Article 15 of the GDPR) is being used by some data subjects to acquire more information than was originally intended by the GDPR. ↗
ANITEC-ASSINFORMITthe GDPR, our members provide modalities to enable data subjects to exercise their rights. For example, with respect to Article 15, 17 and 20 of the GDPR, our members provide self‐service tools to allow a user to control their own account. 11 These ↗
ISPA-Internet Service Provdiers AustriaATrs/suppliers, website users, other data subjects who are "from outside" with the for the controllers interact). • Access to data (Article 15) The wording of Art 15 was not easy to interpret in practice, although recent ECJ rulings have provided clarity. Howeve ↗
Council of the Notariats of the EUBEation obligations, including the type and level of detail of the information to be provided (Articles 12 to 14) • Access to data (Article 15) The right of access is increasingly being used in litigation and pre-litigation proceedings. • Rectification (Article ↗
ACT | The App AssociationBE08/02/2024 ACT | The App Association | Rue de la Loi 23, 1040 Brussels | www.actonline.org | [email protected] • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • M ↗
EuroISPA (European Internet Services Providers Association)BEand level of detail of the information to be provided (Articles 12 to 14) Ref. Ares(2024)973400 - 08/02/2024 2 • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • M ↗
Verband der öffentlichen Wirtschaft und Gemeinwirtschaft Österreichs (VÖWG)AT& 58 iVm Art. 12 & 15: Besonders im technischen bzw. medizinischen Bereich stehen Verantwortliche bei z.B. Auskunftsbegehren gem. Art. 15 vor der Herausforderung, dass die DSGVO in den genannten Bestimmungen festlegt, dass Informationen gem. Art. 12 Abs. 1 in ↗
Fonds Soziales WienATerhältnismäßigem Aufwand auch im Anwendungsbereich des Art 13 DSGVO gilt. 3. Anmerkungen zu dem Recht auf Erhalt einer Kopie gem. Art 15 Abs 3 DSGVO In der Rechtssache C 487/21 hat der EuGH nun Fragen zu Inhalt und Umfang des Betroffenenrechts auf Kopie gemäß ↗

Source: public consultation submissions and position papers. n = 77 mentions; counted as a literal reference to the article number.

Ask about this article →