Employers face challenges fulfilling data access requests under Article 15 GDPR, particularly in long-term employment. Recent ECJ rulings emphasize that the purpose of a request is irrelevant, and employers may ask for specifics on vague requests. Employers must demonstrate confidentiality interests to deny access and provide copies of requested personal data. Handling large requests requires a pragmatic approach, including seeking further specification from employees. Fulfillment timelines are also crucial; responses are generally expected within a month. Businesses should review data management practices to minimize legal risks amidst ongoing uncertainties in case law.
