Privacy & Cybersecurity Law Blog

On February 28, 2024, the European Data Protection Board (“EDPB”) announced the launch of its latest Coordinated Enforcement Framework action on the right of access. Through the course of 2024, 31 data protection authorities across the European Economic Area, including seven German state-level authorities, will take part in this initiative on the implementation of the right of access. The EDPB selected the right access for its third coordinated enforcement action as it is “at the heart of data protection,” is a right that is very frequently exercised by individuals, and one that is often the basis of complaints to authorities.

To gauge how organizations are complying with the right of access, authorities participating in the Coordinated Enforcement Framework will send questionnaires to organizations to aid in fact-finding exercises or to identify whether a formal investigation is warranted, commence formal investigations, and/or follow-up on ongoing investigations. The results will then be analyzed in a coordinated manner and the authorities will decide on possible further supervision and enforcement actions. In addition, the results will be aggregated to generate insight into the area, and the EDBP will publish a report of the outcome of the analysis.