#62025CC0185Advocate General opinion on GDPR access rights and school headteacher liability
AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.
This opinion examines whether a person can use GDPR access rights to learn who supplied negative personal information about them in a workplace-style setting. The case involves an Austrian school headteacher who asked a third party about a programme coordinator, then emailed a request that someone else be proposed for the role. The opinion focuses on who counts as the data controller when an employee or public official uses a professional email account, whether the source of an opinion about a person must be disclosed, and whether the headteacher can be shielded from compensation claims. It matters for schools, public bodies, employers and compliance teams handling subject access requests involving references, opinions or informal background checks.
AI-generated summary. May contain errors. Refer to official sources for legal decisions.
Key Changes
- Clarifies how GDPR access rights may apply to opinions and informal background comments about a person.
- Examines whether a public official or employee can personally be treated as a data controller when using a professional email account.
- Addresses whether excluding individual liability for compensation is compatible with GDPR rules.
Obligations
What this law requires
In the Advocate General's view, Article 15(1)(g) GDPR concerns a data subject's right to obtain available information about the source of personal data when the data were not collected from the data subject, including in a case where the personal data consist of an opinion about the data subject based on a discussion with a third party.
The opinion examines whether a natural person acting as head of a public body and using a professional email account may be treated as determining the purposes and means of processing personal data in an email about another person.
The opinion addresses whether information identifying a third party who supplied an opinion about the data subject may fall within the GDPR access right to available information as to the source of the personal data.
The opinion addresses whether national rules can exclude the personal liability of a headteacher for compensation claims under Article 82 GDPR where damage is alleged to have resulted from a breach of the right of access.