The individual and collective value of data subject access rights

  • Panel
  • Grande Halle
  • Friday 22.05 — 14:15 - 15:30

Organising Institution

Université Paris 8 - CÉMTI

France

Since its establishment as an Experimental University Centre in Vincennes in 1969, and its relocation to Saint-Denis in 1980, Paris 8 University has become a leading research and higher education centre in France. The innovative nature of the University’s courses reflects its history of offering pioneering new fields of study hitherto rarely seen in French academia, such as computer science, geopolitics, cinema, visual arts and gender studies. The CÉMTI is a research centre from that university that integrates the communicational study of media with an analysis of the social, economic, and cultural dynamics at play, while also considering the specificity of spaces, media devices, actors, and the public policies that shape them. It hosts the ANR-DATARights research project on the uses of data subject access rights.
  • Academic 2
  • Business 2
  • Policy 2
The right to access personal data is one of the oldest pillars of data protection law, dating back all the way to the world’s first data protection laws of the 1970s. Yet, in its Digital Omnibus proposed in November 2025, the European Commission proposed to significantly restrict this right. Taking stock of decades of case law and experience, as well as results of research projects on the subject matter, this panel aims at bringing perspectives from academia, civil society and the industry to ask two questions: what is the value of this right? Do the proposed changes provide real and meaningful simplification for data controllers?

Questions to be answered

  1. What is the value and purpose of the right to access personal data to individual data subjects?
  2. How can this individual right be leveraged to build collective trust in the age of IA?
  3. How and to what extent have data controllers invested into usable data access mechanisms?
  4. Can we make data subject access requests simpler both for data subjects and data controllers?

Moderator

Julien Rossi

Université Paris 8 - CÉMTI - France

Julien Rossi is an Associate Professor at the University of Paris 8, affiliated to the Centre for the Study of Media, Technology and Internationalisation (CEMTI). He co-chairs the Working Group on Internet Governance and Regulation of the Research Network on Internet, AI and Society at CNRS. His research focuses on the interdisciplinary study of privacy and data protection law and public policy. He currently coordinates the ANR DATARights project on the uses of data subject access rights.

Speaker

René Mahieu

Open Universiteit - Netherlands

Dr. René Mahieu is Assistant Professor of data protection and privacy law at Open University Netherlands, and affiliated researcher at LSTS. He is writing a monograph on the right of access to personal data in the EU to be published at OUP. His current research focuses primarily on questions around effective enforcement of data protection law by national supervisory authorities. In 2023-2024 he combined his academic work with work as Senior Advisor on the enforcement strategy at the Dutch data protection authority. René holds a PHD in laws from Vrije Universiteit Brussels. Previously he was a Visiting Scholar at Centre for Philosophy of Natural and Social Science at the London School of Economics, studied Philosophy and Economics at Erasmus University Rotterdam, and has a Masters degree in the Economics of Ageing and Pensions from Tilburg University.

Speaker

Florence Gaullier

Cabinet Vercken & Gaullier, AFCDP and CEDPO - France

Florence Gaullier is partner at Vercken & Gaullier. She’s an IT lawyer for more than 22 years. Her team advises clients (SMEs, mid-market companies, major international groups across all industry sectors, public bodies and non-profit organisations), on advisory and litigation matters in IT law, including data protection law and, more generally, all issues related to the digital aera (platforms, artificial intelligence, security regulations). She is also actively involved in several associations, such as GESTE (an association bringing together the main online publishers in France), Cyberlex, and the French Association of Data Protection Officers (AFCDP – an association bringing together thousands of Data Protection Officers and other data protection professionals), of which Florence is one of the Vice-Presidents, responsible in particular for international matters and the Digital Marketing working group). Florence is also Vice-President of CEDPO (The Confederation of European Data Protection Organisations).