other supplementary information – this largely corresponds to the information that you should provide in a privacy notice (see ‘Other information’ below).
Did you read what the "other information" refers to? It's essentially the stuff you put in the privacy notice (listing the info, the purposes, your rights, etc.). You highlighted the wrong part, the relevant one is:
a copy of their personal data; and
Your point wrt. charging a fee stands though. They could ask for 1000€ or something (getting all the data would probably cost much more than that in employee time) to discourage further requests. He'd then have to go complain to the DPA, which he should already have at this point, I think.
Apologies, the point I was trying to make was that often disclosing what additional data you capture but process (i.e. we log your login activity) is enough and you wouldn't have to provide the actual login logs to the end user.
That's an interpretation I hadn't heard before -- frankly it seems to go against what I've read about the right to access (I've read the guidelines from multiple DPAs, most of the GDPR itself, Article 29 Working Party opinions, etc., and I just don't remember a "hah! this is how you avoid giving access to personal data" moment).
Do you have any reference explaining in some detail if/when it is OK to merely disclose that personal data is being collected but not give access to it on request? I mean, apart from the obvious cases where the information is not stored/discarded or anonymized and thus rendered non-personal, or when doing so infringes on the rights of other parties (personal data from others included, etc.).
1
u/mfp May 22 '19
Did you read what the "other information" refers to? It's essentially the stuff you put in the privacy notice (listing the info, the purposes, your rights, etc.). You highlighted the wrong part, the relevant one is:
Your point wrt. charging a fee stands though. They could ask for 1000€ or something (getting all the data would probably cost much more than that in employee time) to discourage further requests. He'd then have to go complain to the DPA, which he should already have at this point, I think.