KEY POINTS
There is a range of views on ‘access’ as a part of processing under the General Data Protection Regulation (GDPR). Access was not mentioned in Article 4(2) GDPR, but could fit the definition of processing, and could also be included within other forms of processing such as retrieval, storage, and transfer. Many scholars view access as central to the definition of privacy, and differentiate ‘intrusion’ – including acting on the data, from ‘mere intrusion’ – in which data is accessed but nothing further is done. The intrusion/mere intrusion distinction may be irrelevant for the applicability of GDPR, as even ‘mere intrusion’ will generate subjective privacy harm, and may lead to objective privacy harm …
€
Arye Schreiber, Mere access to personal data: is it processing?, International Data Privacy Law, volume 10, issue 3, August 2020, pages 269–277, https://doi.org/10.1093/idpl/ipaa005.
First posted 2020-09-18 12:38:52
Leave a Reply