GDPR vs. Copyright for a recommendation letter
<p>Spurred by a discussion on <a href="https://academia.stackexchange.com/questions/110341/does-the-gdpr-entitle-students-to-see-their-recommendation-letters">academia.se</a>: suppose prof. X writes a letter of recommendation for her student mr. Y, and sends it to university Z through an on-line system. Then, the student mr. Y writes an official letter to university Z asking to see all the personal data stored about him. University Z is in Europe, so GDPR applies.</p>

<p>The letter contains some of mr. Y's personal data (his full name, for instance). On the other hand, the letter is a text written by prof. X, and she retains full copyright over it and can prevent further redistribution.</p>

<p>What should University Z do in this case? Do they have an obligation to show the recommendation letter to the student? Is there a solution that does not infringe anyone's rights?</p>

<blockquote>
  <p>The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.</p>
</blockquote>

<p><a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">Article 15 GDPR</a></p>

<p>Assuming that revealing the information would be a clear copyright breach (which is by no means certain), it is not permitted.</p>

<p>It just happens that EU copyright law lets University Z use a photocopier to produce a paper copy of the letter for non-commercial purposees and give that copy to student Y (there are explicit exemption in EU copyright law for using a photocopy-machine for such uses).</p>

<p>So the conflict between the GDPR and Copyright law implied in the question does not exist. If it follows from GDPR that student Y has right to access this personal data (this may not always be the case), university Z must give student Y access to the letter (perhaps after redacting personal-data about <em>other</em> data subjects if such redacting is required by the GDPR).</p>

<p>No-one's rights are infringed by this.</p>

copyright privacy european-union gdpr academia