Data Protection Monitor
Global Privacy & Data Protection Intelligence

European Economic Area (EEA) · Module Detail

European Economic Area: Data Subject Rights

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope.

Primary frameworkGDPR Articles 12-23 (Regulation (EU) 2016/679)
Supervisory authorityEDPB (coordinating 25 national DPAs in the 2026 CEF transparency action)
Traffic-light rationale — AmberRights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope.

Sub-modules (5)

Category narrative257 words

Chapter III (Arts. 12–23) GDPR guarantees transparent information (Arts. 13–14), right of access and a free first copy of personal data undergoing processing (Art. 15; CJEU Case C-487/21 Österreichische Datenschutzbehörde and Case C-307/22 FT v DW confirming the right to a free initial copy of medical records even when requested for non-data-protection litigation), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction (Art. 18), data portability (Art. 20, reinforced from 12 September 2025 by real-time IoT/connected-product data switching rights under the EU Data Act Regulation (EU) 2023/2854), objection (Art. 21, unconditional for direct marketing), and rights against solely automated decision-making (Art. 22). In Case C-203/22 Dun & Bradstreet Austria (27 February 2025), the CJEU held that under Art. 15(1)(h) GDPR a controller conducting automated credit scoring must explain the actual procedure and principles applied to the data subject's profile so the individual can verify accuracy and consistency, and cannot rely on a blanket 'trade secrets' refusal (instead disclosing contested algorithms to the DPA or court for case-by-case balancing). Response deadlines under Art. 12(3) are one calendar month from receipt, extendable by two further months for complex or numerous requests upon notice within the first month. Under the Digital Omnibus Proposal COM(2025) 837 final (legislative proposal, not yet in force), the Commission has proposed clarifying Art. 12(5) so that abusive DSARs pursued solely for non-data-protection purposes (such as pre-trial discovery abuse) may be treated as manifestly unfounded or excessive, though the EDPB–EDPS Joint Opinion 2/2026 (10 February 2026) opposed restricting access rights on motive grounds.

Sources and claims (5)
  1. ConfirmedEDPB — The CJEU has confirmed (Case C-307/22) that data subjects may legitimately exercise the Article 15 right of access for objectives other than becoming aware of processing or verifying its lawfulness, without needing to provide particular motivation.observed
  2. Confirmedunavailable — The Digital Omnibus proposes to give controllers legal clarity for cases of abuse of rights by data subjects, but the EDPB and EDPS consider that exercising the access right for purposes other than data protection should not itself be treated as an element defining abuse.
  3. ConfirmedEDPB — The EDPB ran a year-long 2025 Coordinated Enforcement Framework action on the Article 17 right to erasure/right to be forgotten, adopting a report on the action's findings in 2026.observed
  4. ConfirmedEDPB — The right to data portability under Article 20 GDPR continues to be interpreted per the WP29 Guidelines on the right to data portability, as endorsed by the EDPB.observed
  5. ConfirmedEDPB — During 2026, 25 DPAs across Europe are participating in the EDPB's Coordinated Enforcement Framework action assessing controller compliance with Article 12-14 transparency and information obligations that condition the effective exercise of data subject rights.observed