Data protection information: What information do I have to provide?

When was the last time a data subject asked you to provide the personal data you have processed?

More and more often, those affected are aware that, within the framework of the General Data Protection Regulation (GDPR) have been given new rights to effectively protect their personal data.

Pursuant to Article 15(1) GDPR have affected The right to data protection information: information about which of their personal data is processed by a controller. The right to data protection information is therefore a core element of the GDPRto fulfill the transparency obligations of those responsible.

It provides particular protection for those affected and is now also becoming increasingly popular in the context of employment relationships. From our experience, we know that more and more employees are exercising their right to access data to obtain information from their employer about which personal data the employer is processing or has processed in connection with the employment relationship.

We are therefore often asked what information—and, in particular, to what extent—an employer is required to disclose in response to a request for information from (former) employees.

Definition of personal data

Firstly, the question arises as to which information is covered by the term "personal data" and is therefore part of the information provided by the employer. In addition, it must be clarified for each request for information in what form and to what extent the information may be disclosed. This is because Article 15(3) GDPR provides that affected persons also receive a copy of their personal data should receivewhich are the subject of the Processing are.

For example, it must be clarified whether complete copies of files must be made and released. How should the protection of third-party rights or the protection of trade secrets be handled?

According to the wording of Article 15(1), the right to information under data protection law concerns GDPR a request for information about the personal data processed by the employer (subject of the Processing). However, this does not regularly mean the publication of all documents, e-mails, images, evaluations, etc., which contain, for example, the name of the person concerned or any other information about this person.

Therefore, there is no need for a verbatim copy of every document in which, for example, the name or email address of the data subject appears (see Regional Court of Cologne, Case No. 26 O 25/18, and European Court of Justice, Case C-372/12).

The Right to information in accordance with Article 15 GDPR does not, in our opinion, constitute a justified general claim to copies of all documents or files that personal data of those affected.

Dealing with Government Agencies

To comply with the requirements established by the data protection supervisory authorities regarding requests for information, we recommend implementing the request for information through a phased process.

In a staggered process, the persons seeking information (employees) first receive the information specified in Article 15(1) after submitting a request for information. GDPR information mentioned above. In addition, you will receive a copy with an extended master data record containing the essential relevant information that is the subject of the Processing are made available.

We are happy to support you in implementing the requirements in accordance with Article 15 GDPR. For example, you can give employees access to specially organized information systems, from which they can select the relevant information themselves. personal data can access.