The EDPB has finalised its guidance on data subject access rights after public consultation. The guidance covers the aim and overall structure of the right, general considerations in respect of assessing the request, the scope of the right, how to provide access and the limits and restrictions on the rights. We will look in more detail at the guidance in upcoming digests.
The EDPB has also adopted a final version of a targeted update to the guidance on identifying a controller or processor’s lead supervisory authority concerning joint controllers. The new guidance provides that the joint controllers do not have the power to decide who the lead supervisory authority is and cannot designate one main establishment for the joint controllers in order to help determine the lead supervisory authority. This is a change from the previous guidance and we would advise reviewing joint controllership arrangements to ensure the new guidance is taken into account.
The guidance can be found here.
