data-protection
A general question under Personal Data Privacy
<p><p>Suppose X is a student body that holds a database of comments made by its members about the lecturers of ABC University. Professor Y from ABC requests X to send him a copy of all comments about him. Should X comply, and if so, how?</p><p>Additionally, Suppose there is a comment that says <i>"Y is the worst lecturer in ABC University"</i>.</P><p>Suppose the head of the History Department requests X for comments on all the lecturers of the History Department at ABC University, should he comply?</p><p><p> My understanding is he doesn't need to comply in any of the three cases as other data users, i.e respective members who posted the comment controls the use of the data. Would that be right?</p></p>

<p><a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">Art. 15(4) GDPR</a> says:</p>

<blockquote>
  <p>(4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.</p>
</blockquote>

<p>If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this. </p>

<p>In addition, <a href="https://gdpr-info.eu/art-85-gdpr/" rel="nofollow noreferrer">Art. 85 GDPR</a> requires member states to:</p>

<blockquote>
  <p>[...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...]</p>
</blockquote>

<p>So you <em>may</em> be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database).</p>

<p>The second case seems just like the first in terms of GDPR, but <em>may</em> constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on <a href="https://en.wikipedia.org/wiki/Defamation#Germany" rel="nofollow noreferrer">Defamation</a> explains the situation in each member state in more detail.</p>

<p>In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.</p>
