{"id":1145,"date":"2026-04-02T07:00:03","date_gmt":"2026-04-02T05:00:03","guid":{"rendered":"https:\/\/pavleas-avocats.com\/?p=1145"},"modified":"2026-05-01T07:09:33","modified_gmt":"2026-05-01T05:09:33","slug":"automating-the-right-of-access-to-personal-data-held-by-public-bodies","status":"publish","type":"post","link":"https:\/\/pavleas-avocats.com\/en\/automating-the-right-of-access-to-personal-data-held-by-public-bodies\/","title":{"rendered":"Automating the Right of Access to Personal Data Held by Public Bodies"},"content":{"rendered":"\n<p>The automation of the right of access to personal data held by public bodies is no longer a distant prospect, it is a legal evolution currently being consolidated. This is a defining issue, sitting at the intersection of the GDPR, civil law, European data law&#8230; and a technical reality in which public administration is already, to a large extent, API-compatible. The legal framework is already in place.<\/p>\n\n\n\n<p>The GDPR enshrines a fundamental right of access to data. Civil law allows this right to be exercised by proxy. European law, through the Data Governance Act (DGA), has institutionalised a trusted intermediary: the PSID (Personal Data Intermediation Service Provider). The Digital Omnibus package, currently being adopted at European level, goes further still: it enshrines a logic of automation and machine-readable formats for the exercise of rights, in line with the Data Act.<\/p>\n\n\n\n<p>The real obstacle is no longer legal, it is operational. The one-month deadline set out in Article 12 of the GDPR was designed for manual processing. But when identification is secured (eIDAS), the request is carried by a regulated PSID, and public administration already has APIs in place (open data, interoperability), maintaining manual processing becomes difficult to justify.<\/p>\n\n\n\n<p>Regulators themselves confirm this trajectory, though with caution. In their opinion on the Digital Omnibus, the EDPB and the EDPS:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>support the objectives of simplification and competitiveness,<\/li>\n\n\n\n<li>confirm that exercising the right of access is not abusive even when it serves other purposes (e.g. economic re-use),<\/li>\n\n\n\n<li>but stress the need to maintain a high level of transparency, legal certainty, and safeguards.<\/li>\n<\/ul>\n\n\n\n<p>In other words: automation is legitimate, provided it is governed, traceable, and properly framed.<\/p>\n\n\n\n<p>The real question therefore becomes one of interpretation. Can a one-month deadline still be considered the &#8220;shortest possible timeframe&#8221; when data is available in real time and both the technical and legal conditions are met? Our position is clear: where the infrastructure exists, automated access via API represents the standard for the effective exercise of the right of access. Failing to recognise this would amount to artificially maintaining friction&#8230; in precisely the area where European law seeks to eliminate it.<\/p>\n\n\n\n<p>I had the pleasure of developing these thoughts in <em>D\u00e9cideurs Magazine<\/em>, alongside George Papadopoulos. The full article is available here:<em> <a href=\"https:\/\/www.decideurs-magazine.com\/digital-marketing\/64003-automatisation-du-droit-d-acces-aux-donnees-personnelles-detenues-par-les-organismes-publics-une-mise-en-oeuvre-legale-et-attendue.html\">Automatisation du droit d\u2019acc\u00e8s aux donn\u00e9es personnelles d\u00e9tenues par les organismes publics : une mise en \u0153uvre l\u00e9gale et attendue &#8211; DECIDEURS MAGAZINE &#8211; Acc\u00e9dez \u00e0 toute l\u2019actualit\u00e9 de la vie des affaires : strat\u00e9gie, finance, RH, innovation<\/a><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The automation of the right of access to personal data held by public bodies is no longer a distant prospect, it is a legal evolution currently being consolidated. This is a defining issue, sitting at the intersection of the GDPR, civil law, European data law&#8230; and a technical reality in which public administration is already, [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1146,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1145","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-non-classifiee"],"acf":[],"_links":{"self":[{"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/posts\/1145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/comments?post=1145"}],"version-history":[{"count":1,"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/posts\/1145\/revisions"}],"predecessor-version":[{"id":1148,"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/posts\/1145\/revisions\/1148"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/media\/1146"}],"wp:attachment":[{"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/media?parent=1145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/categories?post=1145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pavleas-avocats.com\/en\/wp-json\/wp\/v2\/tags?post=1145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}