Mr. Denis Kelleher:

Ultimately, someone is entitled to have a right of access. He or she is entitled to access his or her personal data, but that appears to be a separate right to the existing right to a copy of one's personal data. It will require some secure portal. How that will be managed and rolled out will obviously be very challenging. However, that is what the GDPR seems to expect, that a person will have a right to access his or her personal data, a right to see the purposes for which his or her data are being processed and so forth and a right to obtain a copy of his or her personal data, if required. It is a very onerous obligation.