The right of access, also referred to as right to access and (data) subject access, is one of the most fundamental rights in data protection laws around the world. For instance, the United States, Singapore, Brazil, and countries in Europe have all developed laws that regulate access to personal data as privacy protection. The European Union states that: "The right of access occupies a central role in EU data protection law's arsenal of data subject empowerment measures."[1] This right is often implemented as a Subject Access Request (SAR) or Data Subject Access Request (DSAR).[2]
The aspirational Sustainable Development Goal 16, target 9, calls for the provision of legal identity for all human beings. "In the digital economy, this becomes the right to a digital identity."[3] Such an identity could help in filing subject access requests.
Brazil's General Data Protection Law (LGPD) is its first comprehensive data protection regulation. According to LGPD, subject access requests need to be fulfilled within 15 days.[4]
The right of access is enshrined as part of the fundamental right to data protection in the Charter of Fundamental Rights of the European Union. It is in fact the only one of the practical rights relating to personal data that is listed there.
In the GDPR, this right is defined in various sections of Article 15. There is also a right to access in the GDPR's partner legislation, the Data Protection Law Enforcement Directive.[5] The European Data Protection Board (EDPB) has considered it "necessary to provide more precise guidance on how the right of access has to be implemented in different situations".[6] When the EU Directive is transposed into Member State national law, the right of access may be suspended or restricted, as in the case of Germany in Article 34 of its Bundesdatenschutzgesetz.[7] Moreover, on the European level, Europol offers a right of access.[8]
Personal data in Singapore is protected under the Personal Data Protection Act 2012 (PDPA). The PDPA establishes a data protection law that comprises various rules governing the collection, use, disclosure and care of personal data. Access to personal data is laid out as part of Part IV, chapter 21 which states that on request of an individual, an organization shall, as soon as reasonably possible, provide the individual with:[9]
In the United Kingdom, the website of the Information Commissioner's Office states regarding Subject Access Requests (SARs):[10]
Before the General Data Protection Regulation (GDPR) came into force on 25 May 2018,[11] organizations could charge a specified fee for responding to a SAR, of up to £10 for most requests.
Five federal laws include a right of access to personal data:
In addition, some state laws like the CCPA California Consumer Privacy Act have started to include this right.
Data flows between the EU and the US (or at least those going West, towards the US) are governed by the EU–US Privacy Shield. One of the Privacy Shield principles is the right of access.[12] Indeed, it is most fundamental in enabling accountability mechanisms around personal data processing. This example demonstrates that a European-style conception of privacy does not necessarily have to be perceived by American actors as unduly imposing new restrictions on free speech by data subjects.
This Privacy Shield practice also shows that the case of civilian data protection (as under GDPR) is quite different from the case of criminal investigation, where a right of access is exercised as a "data request" by a government, not an individual, as in the US Supreme Court case Microsoft Corp. v. United States. The individual in criminal cases does maintain a right to know what data is being used about him/her, and of what crime he or she is accused.[13]