What should be done when the police or a court request original documents collected under the Blue Card procedure?

ANSWER

In this case, the right under Article 15 GDPR — the right of access to one's personal data — does not apply at all. The right of access under Article 15 GDPR is a right of the data subject, the person whose data are concerned, to verify how their data are processed by a specific controller. The authorities mentioned in the question will be exercising entirely different powers and competences and, on the basis of separate provisions (outside the GDPR, e.g. the Code of Criminal Procedure), will request specific information concerning other persons. Before disclosing such data, the controller's role is each time to verify who the request comes from (whether it is actually an authorised authority — the police, prosecution service, etc.), which is particularly important in the case of requests received by email, which may be merely an attempt to fraudulently obtain data.

The controller should then verify whether the entity that submitted the request has a legal basis for such a request and which specific provisions it relies on when requesting information concerning a specific person. Only after successfully verifying both the requesting entity and the legal basis for the request may the controller, usually fulfilling a legal obligation in this respect, disclose third-party data to the authorised authority (which does not then take place in the procedure for exercising the right of access under Article 15 GDPR).