The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how

Abstract

The data subject’s right to access information on data processing has a very broad meaning. Considering the latest developments in this field (mainly the CJEU ruling on Austrian posts and EDPB guidelines) one can draw the conclusion that the controller’s right to protect its confidential information is limited and less valuable than the data subject’s rights. However, this may lead to unfair and unequal treatment of companies and data subjects. When looking at this right in a more systematic perspective, it seems that the model of the protection of personal data may go hand in hand with the control-lers’ business interests. A different interpretation may lead to the discourage-ment of entrepreneurs, both EU and foreign, from conducting business in the European Union. This is not conducive to the development of the European market and certainly will not attract foreign capital.