SCENARIO Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use…

According to the GDPR, the right of access by the data subject is one of the rights granted to

individuals to obtain information about the processing of their personal data by a data

controller1. The data controller must provide a copy of the personal data undergoing processing and

additional information, such as the purposes, the categories, the recipients, the retention period, the

rights, the source, and the automated decision-making of the processing1. The data controller must

also inform the data subject of the existence of the right to access and the means to exercise it2.

The GDPR also specifies the time limit for responding to a data subject access request. The data

controller must provide the information without undue delay and in any event within one month of

receipt of the request1. This period may be extended by two further months where necessary, taking

into account the complexity and number of the requests, but the data controller must inform the

data subject of any such extension within one month of receipt of the request, together with the

reasons for the delay1. The data controller must also verify the identity of the data subject before

providing the information, but this verification should not extend the time limit for responding to the

request3.

In this scenario, Mike is an EU resident who has booked travel itineraries through XYZ Travel Agency

and stayed at ABC Hotel Chain’s locations. Both companies are U.S.-based multinational companies

that use a common platform for collecting and sharing their customer data. Mike has signed the

agreement to be a rewards program member of XYZ Travel Agency. Mike wants to know what

personal information the company holds about him and sends an email requesting access to his data.

Assuming that both companies are subject to the GDPR, either because they offer goods or services

to individuals in the EU or because they monitor the behavior of individuals in the EU4, they must

comply with the right of access by the data subject and provide Mike with the information he

requests. The time period in which Mike should receive a response to his request is not more than

one month of receipt of his request, unless there are grounds for extending the period by two further

months. The companies must also verify Mike’s identity before providing the information, but this

verification should not affect the time limit for responding to the request.

Therefore, the correct answer is A. Not more than one month of receipt of Mike’s request.

Reference: 1 Article 15 of the GDPR2 Article 13 and 14 of the GDPR3 Guidelines on the right to data

portability | European Data Protection Board34 Article 3 of the GDPR.