You don’t have the right to make a request and gain access to the information of a 3rd party individual, unless you have been properly appointed as the authorized representative of the original individual seeking access to their information.
The entity receiving your request requires:
- sufficient evidence on your behalf to verify the identity of the data subject making such a request and
- sufficient details on your behalf so it can locate your request.
If the responsible person refuses your Data Subject Access Request on behalf of the entity, they must clearly set out in writing the reasons for the rejection.
If you are not satisfied with the outcome of your request, then you have the right to ask the entity for the details to their independent DPO (Data Protection Officer) to review your case.