choose to compile the e-mail correspondence containing the data subject’s personal data in a file that is provided to the data subject. 151. Making some kind of compilation and extraction of the data that makes the information easy to comprehend is also a way of complying with the requirements to provide the information in a way that is both intelligible and easily accessible. 152. In this context, it is important to remember that there is a distinction between the right to obtain access under Art. 15 GDPR and the right to receive a copy of administrative documents regulated in national law, the latter being a right to always receive a copy of the actual document. This does not mean that the right of access under Art. 15 GDPR excludes the possibility to receive a copy of the document/media on which the personal data appear. 153. In some cases, the personal data itself sets the requirements in what format the personal data should be provided. When the personal data for example constitutes handwritten information by the data subject, the data subject needs in some cases to be provided with a photocopy of that handwritten information since the handwriting itself is personal data. That could especially be the case when the handwriting is something that matters to the processing, e.g. scripture analysis. The same applies in general for audio recordings since the voice of the data subject itself is personal data. In some cases, however, access can be given by providing a transcription of the conversation, e.g. if agreed upon between the data subject and the controller. 154. It should be noted that the provisions on format requirements are different regarding the right of access and the right of data portability. Whilst the right of data portability under Art. 20 GDPR requires that the information is provided in a machine readable format, the right to information under Art. 15 does not. Hence, formats that are considered not to be appropriate when complying with a data portability request, for example pdf-files, could still be suitable when complying with a request of access.
5.3 Timing for the provision of access 155. Art. 12(3) requires that the controller provides information on action taken on a request under Art. 15 to the data subject without undue delay and in any event within one month of receipt of the request. This deadline can be extended by a maximum of two months taking into account the complexity and the number of the requests, provided that the data subject has been informed about the reasons for such delay within one month of the receipt of the request. This obligation to inform the data subject on the extension and its reasons should not be confused with the information that has to be given without delay and at the latest within one month when the controller does not take action on the request, as follows by Art. 12(4). 156. The controller shall react and, as a general rule, provide the information under Art. 15 without undue delay, which in other words means that the information should be given as soon as possible. This means that, if it is possible to provide the requested information in a shorter amount of time than one month, the controller should do so. The EDPB also considers that the timing to answer the request in some situations must be adapted to the storage period in order to be able to provide access77. 157. The time limit starts when the controller has received an Art. 15 request, meaning when the request reaches the controller through one of its official channels. It is not necessary that the controller in fact
77
See 2.3.3.
47 Adopted - version for public consultation
