Dr. Fred Logue:

That is how the GDPR works. There is a general right of access which can only be restricted by legislation that complies with Article 23. It is up to the legislature to define how that works. It is not appropriate for individual data controllers to have to do that balancing test. That is not actually in the GDPR. The idea of mixed personal data is also not in the GDPR. The European Court of Justice has clarified that people have the same right of access to non-mixed personal data as to mixed personal data. By mixed, I mean personal data that is yours and somebody else's at the same time. There is no real distinction between those in the GDPR. It has been made up to try to limit the right of access.

It is just wrong. I cannot put it more bluntly.