Court Overturns DPA Ruling: Balancing GDPR Access Rights Against Legitimate Institutional Interests

The Administrative Court of Cyprus found that the Data Protection Authority failed to properly weigh competing legal interests when ordering a university to grant an assistant professor unrestricted access to confidential evaluation reports during an active promotion procedure. GDPR Article 15 (right of access) is not absolute — it must be balanced against legitimate interests such as protecting third-party confidentiality and procedural integrity. This case highlights that DPAs and organizations alike must conduct structured balancing tests before making access decisions, rather than applying data subject rights mechanically. Failure to document and justify such balancing decisions exposes both regulators and institutions to legal challenge and reputational harm.

Tactical Insight

Immediate actions

Establish a documented legal basis review process for any decision to restrict or grant data subject access requests under GDPR Article 15.
Train HR, legal, and compliance teams to identify scenarios where access rights may conflict with legitimate institutional interests (e.g., ongoing disciplinary or promotion procedures).

Policy & Governance improvements

Develop a formal balancing test framework that weighs data subject rights against third-party confidentiality, procedural integrity, and organizational legitimate interests before responding to access requests.
Create tiered access restriction policies that allow temporary, time-limited holds on sensitive records during active legal or administrative procedures, with clear reinstatement triggers.
Maintain an auditable record of all access request decisions, including the rationale and legal basis for any restrictions applied.

Regulatory & Oversight measures

Engage legal counsel to review DPA guidance and court precedents periodically, ensuring internal policies reflect the evolving interpretation of GDPR rights and exceptions.
Establish a cross-functional review committee (legal, HR, DPO) to adjudicate complex or contested access requests before issuing a final determination.