A first request for access to personal data under Article 15 of Regulation 2016/679 may be 'excessive' within the meaning of Article 12(5) of that regulation even where it formally complies with those provisions, if the controller shows, in the light of all the relevant circumstances, that the request was made not to find out about the processing and verify its lawfulness so that the data subject could then protect his or her rights under that regulation, but with an abusive intention, such as artificially creating the conditions for obtaining an advantage from that regulation. Publicly available information that the data subject has made many access requests to various controllers and then brought claims for compensation may be taken into account in establishing that abusive intention.

A data subject has a right under Article 82(1) of Regulation 2016/679 to compensation for damage caused by an infringement of the right of access in Article 15(1) of that regulation.

A former guardian who acted in a professional capacity for a person under guardianship is a 'controller' under Article 4(7) in relation to personal data about that person in the guardian's possession. Processing of those data must comply with all GDPR provisions, including Article 15.

A controller must provide the data subject, free of charge, with a first copy of the personal data undergoing processing, even if the request is made for reasons unrelated to those mentioned in the first sentence of recital 63.

In a doctor-patient relationship, the first sentence of Article 15(3) gives the data subject a right to a faithful and intelligible reproduction of all personal data being processed. That right includes a full copy of documents in the medical records that contain those data, provided that such a copy is essential to let the data subject verify that the data are accurate and complete and to ensure that they are intelligible. For health data, that right in any event includes a copy of the data in the medical records containing information such as diagnoses, examination results, treating physicians' assessments, and treatment or interventions.

Article 15 of Regulation 2016/679, read in the light of Article 99(2), applies to a request for access submitted after that regulation became applicable, even where the processing operations covered by the request were carried out before that date.

Under Article 15(1) of Regulation 2016/679, a data subject may obtain information about consultations of his or her personal data, including the dates and purposes of those consultations. The data subject is not entitled to the identity of the employees who carried out those consultations under the controller's authority and in accordance with its instructions, unless that information is essential for the effective exercise of the rights conferred by that regulation and the employees' rights and freedoms are taken into account.

Under Article 15(1) of Regulation 2016/679, the scope of a data subject's right of access is not affected, in principle, by the fact that the controller carries on banking business in a regulated activity, or by the fact that the data subject is both the controller's customer and its employee.

Under the first sentence of Article 15(3), the right to obtain a copy of personal data undergoing processing requires the controller to give the data subject a faithful and intelligible reproduction of all those data. That right includes copies of extracts from documents, entire documents, or extracts from databases containing those data, if providing such a copy is essential to enable the data subject to exercise effectively the rights conferred by Regulation 2016/679, taking into account the rights and freedoms of others.

In the third sentence of Article 15(3), the concept of "information" refers only to the personal data of which the controller must provide a copy under the first sentence of that paragraph.

A Petitions Committee of the parliament of a Federated State of a Member State is a "controller" if, alone or with others, it determines the purposes and means of processing personal data. The personal-data processing carried out by that committee then falls within the GDPR, including Article 15.