The right to information: How far does the GDPR go?
Basics of the right to information under the GDPR
Transparency regarding stored personal data is a central element of the General Data Protection Regulation (GDPR).
The right to information under Article 15 GDPR gives data subjects the opportunity to request directly from companies or authorities what data is collected, stored and processed about them. This is to ensure that everyone can understand how and for what purpose their personal information is being used.
Companies are obliged to disclose the data processed in response to a request for information and to explain the purpose for which it is stored. This right is essential for data subjects to assert their data protection rights or, if necessary, request corrections or deletions.
Conflict with trade secrets: The legal challenge
However, the comprehensive right to information is limited when confidential company information – so-called trade secrets – is involved.
On the one hand, companies must ensure transparency, while on the other hand protecting their internal trade and business secrets. The Trade Secrets Act, which has been in force since 2019, protects particularly sensitive internal information from unauthorised access and disclosure. In the event of a conflict, however, companies are obliged to provide specific reasons and evidence as to why the disclosure of certain data would jeopardise trade secrets.
Data protection supervisory authorities or courts then examine the individual case and weigh up whether the company's interest in confidentiality outweighs the transparency interests of the data subject.
Further limitations and practical tips on the obligation to provide information
Protection of third-party rights and abusive requests
The obligation to provide information may not only be limited to trade secrets. The protection of third-party rights also plays a role. As soon as a request for information concerns information that also affects third parties, such as other people in emails, the company may restrict or even refuse disclosure.
The GDPR also provides for restrictions on excessive or manifestly abusive requests for information. In such cases, companies can refuse to disclose the information, but in case of doubt, they must explain in detail why the specific request is considered abusive or disproportionate.
Pragmatic recommendations for companies when dealing with requests for information
A proven tip for companies is to ensure that personal data is omitted as far as possible when creating documents, provided that this is organisationally feasible. This helps to reduce conflicts in advance.
Where personal data and protected internal information cannot be separated, the only option is to carefully examine each individual request for information. In case of doubt, companies should weigh up the risks and seek legal advice if they are unsure in order to reconcile the requirements of the GDPR with the protection of their business interests.
Conclusion: Right to information between transparency and confidentiality
Finding a balance between data protection and corporate protection
The right to information plays a key role in modern data protection. It is more than just a claim to information – it represents the legitimate interest in transparency and control over one's own data. At the same time, companies cannot be forced to disclose sensitive trade secrets lightly. Each request therefore requires a balanced consideration of the interests involved.
Ultimately, it comes down to a carefully balanced compromise: the rights of data subjects must not be undermined, while at the same time trade secrets must be preserved and third parties protected. Without legal expertise and clear structures within the company, this balancing act is often difficult to master.
Support with complex requests for information
Whether you are a business owner who has received specific requests or a data subject who would like to know more about your stored data, the limits and possibilities of the right to information are not always intuitive. A thorough analysis of each individual case is therefore essential.
Do you need professional support in assessing or implementing requests for information under the GDPR? Or would you like to design your internal processes in compliance with data protection regulations and avoid conflicts from the outset? Then don't hesitate to contact us! We are at your side with expert advice and provide you with individual and practical support.