Navigating third-party data access requests

The Irish DPC’s guide on accessing data on behalf of someone else remains relevant but incomplete. (It dates back to 2021 and has just been republished, in case anyone thought it sounded familiar.)

It touches upon a very difficult issue – and one less clear-cut than the Irish DPC suggests.

Yes, there are good reasons for people assisting others: interpreters, digitally-savvy people helping those less familiar with online tools, etc. And no, on paper the GDPR doesn’t prohibit the intervention of someone else (personally, I strongly dislike “we can’t because of the GDPR” excuses).

But the truth is far less simple – because of situations where less strong verifications or more flexibility can be used as an argument against a controller.

In matters I have worked on, I have seen organisations being actually *forced* to enforce heightened identity checks because they get attacked for data breaches in the case of spousal/partner relationships turning sour and being misused for access to data.

I have even witnessed a company being pretty much forced to abandon a mechanism that was in place to facilitate access by less tech-savvy people to their accounts because a data protection authority questioned the sufficiency of similarly flexible identification methods deployed in the same circumstances by a competitor.

Ultimately, not every controller wants (or is able) to set aside a litigation budget to manage that risk, so some choices may have to be made.

There is no perfect solution – so while the Irish DPC’s guide is excellent, organisations are always permitted (and should be encouraged) to make their own assessment of which response to use.

Link to the Irish DPC’s guide:
– LinkedIn article: https://lnkd.in/eyxf-V_Z
– Original blog post of the DPC: https://lnkd.in/etKqPGYk

privacy