CJEU finds that fees can be charged for data subject access requests, as long as they’re not excessive
As we noted in a previous post, data subject access requests can often be an onerous burden on any organisation that receives them, as they must produce a significant volume of documents containing the personal data of the person making the request. It can be a lengthy and costly exercise.
On 12 December 2013, the CJEU clarified an ambiguity in certain language versions (including English) of the Data Protection Directive 95/46/EC as to whether a data controller is entitled to levy a fee for the work involved. It held that, as a matter of EU law, there is nothing to prevent charging a fee for the request, provided it is not excessive. It found that, in order for a fee to not be ‘excessive’, it cannot exceed the cost of providing the personal data sought.
Irish law allows the charging of a fee for access requests, with the maximum set at €6.35 by a 1988 statutory instrument. This is from a different time – €6.35 is now negligible in comparison with the cost of communicating the amount of personal data typically held by organisations today. When it is considered that the High Court recently held that access requests can be made in the context of litigation, without many of the controls offered by the discovery regime, this only adds to the potential costs of a lawsuit.
Unfortunately for organisations receiving access requests the draft of the forthcoming EU Data Protection Regulation provides that access requests should be free of charge. With that Regulation on the horizon, this decision by the CJEU is unlikely to change the low-fees policy currently in place in Ireland.