Data Subject Access Requests: why they matter and proposed changes under Digital Omnibus Package

Over the past years, data subject access requests (DSARs) under Article 15 GDPR have increasingly become a common mechanism used by employees, including in the context of dismissal disputes, where they seek to obtain detailed access to, and information about, how their personal data has been processed by their employer.

Deadline

As a principle, employers who receive a DSAR must respond within 1 month (subject to potential extensions for complex cases). 

Surge in DSARs in end-of-employment situations

DSARs are increasingly used by employees in end-of-employment situations and there have been reports that 1 in 3 dismissal actions now involves a DSAR.

And where does the Digital Omnibus Package come in?

The Digital Omnibus Package proposal seeks to technically adjust parts of the GDPR, including a more structured and proportionate right of access, with the aim of reducing administrative burdens for organisations. 
 
Specifically in relation to DSARs, the European Commission has proposed to extend the right to refuse such requests, or charge a reasonable fee for responding to such requests, in situations where data subjects abuse their rights under the GDPR “for purposes other than the protection of their data”. 
 
Though not yet adopted, this proposal signals that the EU has clearly heard employers’ concerns regarding disproportionate DSAR burdens.