{"id":101691,"date":"2025-12-08T22:58:50","date_gmt":"2025-12-08T21:58:50","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=101691"},"modified":"2025-12-08T23:11:11","modified_gmt":"2025-12-08T22:11:11","slug":"access-to-log-files-under-the-gdpr-are-you-allowed-to-know-which-employee-has-viewed-your-file","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/inzage-in-logbestanden-onder-de-gdpr-mag-u-weten-welke-werknemer-uw-dossier-heeft-bekeken\/","title":{"rendered":"Access to log files under the GDPR: are you allowed to know which employee has viewed your file?"},"content":{"rendered":"

The right of access is one of the cornerstones of the General Data Protection Regulation (GDPR)<\/a>. Many citizens wonder how far this right extends: as a data subject, can you demand that an organization, such as a government agency or bank, disclose exactly which specific employee has accessed your file and at what time? The answer is nuanced. Although you have the right to access the processing history (log files), the Court of Justice of the European Union ruled in a ruling of 3 December 2025 (Cases T-318\/24 and T-362\/24<\/a>) that this does not automatically mean that you will be given the names of individual employees.<\/p>\n\n\n\n

The facts and context<\/h2>\n\n\n\n

This legal issue was addressed in a case before the General Court of the European Union (hereinafter: the General Court) between a job applicant and the European Personnel Selection Office (EPSO)<\/sup><\/sup><\/sup><\/sup>.<\/p>\n\n\n\n

The applicant, who had participated in various selection procedures, submitted a request for access based on Regulation<\/a> <\/a>(EU) 2018\/1725<\/a>. This is a specific regulation for EU institutions, which is virtually identical in content to the general GDPR that applies to Belgian companies and public authorities.<\/p>\n\n\n\n

Among other things, the applicant demanded full access to the \u201clog files\u201d of his profile. He wanted to know not only when his file had been consulted, but also by whom (the identity of the EPSO staff members) and for what specific purpose. EPSO refused to disclose the names of the staff members, citing the protection of their rights and freedoms. In addition, the applicant demanded the \u201crestoration\u201d of data that EPSO had deleted after a retention period of two years.<\/p>\n\n\n\n

The decision of the General Court<\/h2>\n\n\n\n

The General Court upheld the European Commission's (responsible for EPSO) position on all counts and dismissed the applicant's claims.<\/sup>.<\/p>\n\n\n\n

1. No automatic right to employee names<\/strong> <\/p>\n\n\n\n

The Court referred to the earlier Pankki S judgment<\/a> of the Court of Justice. It ruled that employees who process personal data under the authority of their employer are not considered \u201crecipients\u201d of that data within the meaning of data protection law. Although log files contain useful information about the lawfulness of the processing, the interest of the data subject in knowing the identity of the employee does not generally outweigh the rights and freedoms of those employees. Unless this information is essential for the data subject to exercise their rights (e.g., in the case of a concrete suspicion of abuse), the controller is not required to disclose the names of its staff.<\/p>\n\n\n\n

2. Deletion is permanent<\/strong> <\/p>\n\n\n\n

The Court confirmed that the deletion of data after the expiry of the retention period constitutes lawful processing. Data protection law does not recognize a \u201cright to restoration\u201d of lawfully deleted data.<\/p>\n\n\n\n

3. Access to data, not documents<\/strong> <\/p>\n\n\n\n

Finally, the Court reiterated that the right of access relates to the personal data itself, and not to the documents (such as internal notes, chats, or emails) as such. If the controller claims that certain data does not exist, there is a presumption of lawfulness that the applicant must rebut with evidence.<\/p>\n\n\n\n

Legal analysis and interpretation<\/h2>\n\n\n\n

Thisruling confirms the consistent line in European case law on the balance between the right of access (Article 15 GDPR \/ Article 17 Regulation 2018\/1725) and the rights of third parties.<\/p>\n\n\n\n

The key point is the interpretation of the term \u2018recipient\u2019.\u2018<\/strong>. The legislation requires organizations to be transparent about the recipients to whom data is provided. However, internal staff acting under the instructions of the controller do not legally qualify as \u2018recipients\u2019 (third parties), but as an extension of the organization itself.<\/p>\n\n\n\n

This is of great importance in practice. An unlimited right to access information about who clicks on which file internally could lead to the \u201cnaming and shaming\u201d of employees or civil servants who are simply doing their job. The Court applies a proportionality test here:<\/strong><\/p>\n\n\n\n