Mr. Simon McGarr:

There is very clear clarity in the law. Anybody who is a data controller, in the context of information being held and any personal data they are holding, has a duty to provide that data to the individuals if they ask them. One cannot restrict the identities that are allowed to be asked for data and nor can one restrict who may ask for their own personal data. Everyone covered by the GDPR have a right to make an access request to anybody, whether private or State.