---
title: "European Economic Area — Data Subject Rights | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/european-economic-area-bloc/data-subject-rights/
source_html: /jurisdictions/european-economic-area-bloc/data-subject-rights/index.html
description: "European Economic Area (Bloc) — Data Subject Rights (Amber, 5 sub-modules, 5 claims): Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarificatio"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 79096fde46437db6af9a639df74bb54b68a40a509a26ee553e1b6d9d5a0de616
generator: "fe-fleet/md-twin@1.0"
---
# European Economic Area — Data Subject Rights | Data Protection Monitor

### D3Data Subject Rights5 sub-modules5 claimsAmber▾#

Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope.

Primary framework GDPR Articles 12-23 (Regulation (EU) 2016/679)

Supervisory authority [EDPB (coordinating 25 national DPAs in the 2026 CEF transparency action)](https://www.edpb.europa.eu/)

Traffic-light rationale — Amber Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope.

#### Sub-modules (5)

Category narrative 257 words

Chapter III (Arts. 12–23) GDPR guarantees transparent information (Arts. 13–14), right of access and a free first copy of personal data undergoing processing (Art. 15; CJEU Case C-487/21 Österreichische Datenschutzbehörde and Case C-307/22 FT v DW confirming the right to a free initial copy of medical records even when requested for non-data-protection litigation), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction (Art. 18), data portability (Art. 20, reinforced from 12 September 2025 by real-time IoT/connected-product data switching rights under the EU Data Act Regulation (EU) 2023/2854), objection (Art. 21, unconditional for direct marketing), and rights against solely automated decision-making (Art. 22). In Case C-203/22 Dun & Bradstreet Austria (27 February 2025), the CJEU held that under Art. 15(1)(h) GDPR a controller conducting automated credit scoring must explain the actual procedure and principles applied to the data subject's profile so the individual can verify accuracy and consistency, and cannot rely on a blanket 'trade secrets' refusal (instead disclosing contested algorithms to the DPA or court for case-by-case balancing). Response deadlines under Art. 12(3) are one calendar month from receipt, extendable by two further months for complex or numerous requests upon notice within the first month. Under the Digital Omnibus Proposal COM(2025) 837 final (legislative proposal, not yet in force), the Commission has proposed clarifying Art. 12(5) so that abusive DSARs pursued solely for non-data-protection purposes (such as pre-trial discovery abuse) may be treated as manifestly unfounded or excessive, though the EDPB–EDPS Joint Opinion 2/2026 (10 February 2026) opposed restricting access rights on motive grounds.

Evidence 5

Sources and claims (5)
- Confirmed[EDPB](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf) — The CJEU has confirmed (Case C-307/22) that data subjects may legitimately exercise the Article 15 right of access for objectives other than becoming aware of processing or verifying its lawfulness, without needing to provide particular motivation.observed 2026-08-05
- Confirmedunavailable — The Digital Omnibus proposes to give controllers legal clarity for cases of abuse of rights by data subjects, but the EDPB and EDPS consider that exercising the access right for purposes other than data protection should not itself be treated as an element defining abuse.
- Confirmed[EDPB](https://www.edpb.europa.eu/news/cef-2026-edpb-launches-coordinated-enforcement-action-on-transparency-and-information_en) — The EDPB ran a year-long 2025 Coordinated Enforcement Framework action on the Article 17 right to erasure/right to be forgotten, adopting a report on the action's findings in 2026.observed 2026-08-05
- Confirmed[EDPB](https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf) — The right to data portability under Article 20 GDPR continues to be interpreted per the WP29 Guidelines on the right to data portability, as endorsed by the EDPB.observed 2026-08-05
- Confirmed[EDPB](https://www.edpb.europa.eu/news/cef-2026-edpb-launches-coordinated-enforcement-action-on-transparency-and-information_en) — During 2026, 25 DPAs across Europe are participating in the EDPB's Coordinated Enforcement Framework action assessing controller compliance with Article 12-14 transparency and information obligations that condition the effective exercise of data subject rights.observed 2026-08-05