On Right to Access
GDPR prescribes that the data subject has the right to obtain from the controller confirmation as to whether or not personal data that concerns him or her is being processed.
Access does not only mean access to personal data provided by the data subject, it also means access to every personal data about the data subject even if it was not provided by the latter.
According to Bird & Bird, the request must be related to the individual’s rights under data protection. If the purpose is not related, the request may be denied.
After reasonable evaluation, if the request for access would result in a disproportionate amount of effort or resources, the PIC may refuse to comply with the request. The determination of what constitutes disproportionate effort may be made on the basis of the particular circumstances of the request. Factors to consider may include the availability of the information, the need for extraordinary measures to retrieve the information, the purpose of the request, and the necessity and benefit of the requested information to the data subject.