GDPR Article 15 — Right of Access

ID: gdpr-article-15

{
  "@context" : [ "http://www.w3.org/ns/odrl.jsonld", {
    "odrl" : "http://www.w3.org/ns/odrl/2/",
    "dpv" : "https://w3id.org/dpv#",
    "eu-gdpr" : "https://w3id.org/dpv/legal/eu/gdpr#",
    "dqv" : "http://www.w3.org/ns/dqv#",
    "dct" : "http://purl.org/dc/terms/",
    "justifications" : "https://w3id.org/dpv/justifications#",
    "xsd" : "http://www.w3.org/2001/XMLSchema#",
    "ex" : "https://example.com/extensions/accomplish#"
  } ],
  "@type" : "Policy",
  "uid" : "https://accomplish.org/policies/gdpr-policies/gdpr-article_15",
  "profile" : "https://accomplish.org/gdpr#",
  "dct:title" : "GDPR Article 15 — Right of Access",
  "dct:description" : "Comprehensive policy model for GDPR Article 15 establishing the data subject’s right of access to personal data and associated information.",
  "dpv:hasLegalBasis" : "eu-gdpr:A15",
  "permission" : [ {
    "@type" : "Permission",
    "action" : "dpv:Access",
    "regulationReferences" : [ "gdpr-article-15#article-15-1" ],
    "assignee" : {
      "@id" : "https://example.com/controller/datasubject",
      "@type" : "dpv:DataSubject"
    },
    "target" : {
      "@id" : "https://example.com/data/personaldata",
      "@type" : "dpv:PersonalData"
    },
    "duty" : [ {
      "@type" : "Duty",
      "action" : "dpv:MakeAvailable",
      "regulationReferences" : [ "gdpr-article-15#article-15-3" ],
      "assignee" : {
        "@id" : "https://example.com/identity/datacontroller",
        "@type" : "dpv:DataController"
      },
      "constraint" : [ {
        "leftOperand" : "ex:hasEstablishedCommunicationChannel",
        "operator" : "in",
        "rightOperand" : [ "ex:electronic", "ex:paper" ]
      }, {
        "leftOperand" : "ex:hasDocumentedProcedures",
        "operator" : "eq",
        "rightOperand" : "ex:proceduresForResponsesAndNotifications"
      }, {
        "leftOperand" : "dpv:hasTechnicalOrganisationalMeasure",
        "operator" : "isAllOf",
        "rightOperand" : [ "dpv:DataTransferRecord", "dpv:DataProcessingRecord" ]
      }, {
        "leftOperand" : "dpv:hasDataSource",
        "operator" : "eq",
        "regulationReferences" : [ "gdpr-article-15#article-15-1-g" ],
        "rightOperand" : "dpv:DataSubjectDataSource"
      } ],
      "dct:description" : "Provide access to personal data within GDPR Article 15 timeframes and documented procedures.",
      "consequence" : [ {
        "@type" : "Duty",
        "action" : "compensate",
        "target" : {
          "@id" : "https://example.com/controller/datasubject",
          "@type" : "dpv:DataSubject"
        },
        "assignee" : {
          "@id" : "https://example.com/controller/datacontroller",
          "@type" : "dpv:DataController"
        },
        "constraint" : [ {
          "leftOperand" : "payAmount",
          "operator" : "lteq",
          "rightOperand" : {
            "@value" : "20000000.00",
            "@type" : "xsd:decimal"
          },
          "unit" : "EUR"
        } ]
      } ]
    }, {
      "@type" : "Duty",
      "action" : "dpv:MakeAvailable",
      "regulationReferences" : [ "gdpr-article-15#article-15-1" ],
      "assignee" : {
        "@id" : "https://example.com/identity/datacontroller",
        "@type" : "dpv:DataController"
      },
      "target" : {
        "@id" : "https://example.com/data/processinginformation",
        "@type" : "dpv:Data"
      },
      "constraint" : [ {
        "leftOperand" : "dqv:Completeness",
        "operator" : "eq",
        "rightOperand" : 1
      }, {
        "leftOperand" : "dqv:Availability",
        "operator" : "eq",
        "rightOperand" : true
      }, {
        "leftOperand" : "dqv:Understandability",
        "operator" : "eq",
        "rightOperand" : 1
      }, {
        "leftOperand" : "dqv:Conciseness",
        "operator" : "eq",
        "rightOperand" : 1
      }, {
        "leftOperand" : "dqv:Accuracy",
        "operator" : "eq",
        "rightOperand" : 1
      }, {
        "leftOperand" : "dpv:hasHumanInvolvement",
        "operator" : "eq",
        "regulationReferences" : [ "gdpr-article-15#article-15-1-h" ],
        "rightOperand" : "dpv:HumanInvolvementForVerification"
      }, {
        "leftOperand" : "ex:hasCategoriesOfPersonalData",
        "operator" : "eq",
        "regulationReferences" : [ "gdpr-article-15#article-15-1-b" ],
        "rightOperand" : [ "dpv:PersonalData", "dpv:SensitivePersonalData", "dpv:SpecialCategoryPersonalData" ]
      }, {
        "leftOperand" : "dpv:hasJustification",
        "operator" : "isAllOf",
        "regulationReferences" : [ "gdpr-article-15#article-15-1-h" ],
        "rightOperand" : [ "ex:automatedDecisionLogic", "ex:dataTransfersOutsideEU", "justifications:ComplexityOfProcess" ]
      }, {
        "leftOperand" : "dpv:hasRecipient",
        "operator" : "in",
        "regulationReferences" : [ "gdpr-article-15#article-15-1-c" ],
        "rightOperand" : [ "dpv:DataSubject", "dpv:Representative" ]
      } ],
      "dct:description" : "Provide all information required by GDPR Article 15(1): categories of personal data, purposes, recipients, retention, source, rights, and automated decision logic.",
      "consequence" : [ {
        "@type" : "Duty",
        "action" : "compensate",
        "target" : {
          "@id" : "https://example.com/controller/datasubject",
          "@type" : "dpv:DataSubject"
        },
        "assignee" : {
          "@id" : "https://example.com/controller/datacontroller",
          "@type" : "dpv:DataController"
        },
        "constraint" : [ {
          "leftOperand" : "payAmount",
          "operator" : "lteq",
          "rightOperand" : {
            "@value" : "20000000.00",
            "@type" : "xsd:decimal"
          },
          "unit" : "EUR"
        }, {
          "leftOperand" : "dpv:hasStatus",
          "operator" : "neq",
          "rightOperand" : "dpv:RequestActionDelayed"
        }, {
          "leftOperand" : "dpv:hasJustification",
          "operator" : "neq",
          "rightOperand" : [ "justifications:HighVolumeOfProcesses", "justifications:ComplexityOfProcess" ]
        }, {
          "leftOperand" : "odrl:time",
          "operator" : "lte",
          "rightOperand" : "P1M"
        } ]
      } ]
    } ]
  } ],
  "prohibition" : [ {
    "@type" : "Prohibition",
    "action" : "dpv:MakeAvailable",
    "regulationReferences" : [ "gdpr-article-15#article-15-4" ],
    "dct:description" : "Prohibit disclosure that adversely affects the rights and freedoms of others without safeguards (Art. 15(4)).",
    "constraint" : [ {
      "leftOperand" : "ex:hasImpact",
      "operator" : "eq",
      "regulationReferences" : [ "gdpr-article-15#article-15-4" ],
      "rightOperand" : "ex:ImpactOnOthers"
    } ]
  } ]
}