GDPR - Individual Rights
The GDPR is more specific about the information that need to
be provided to people about what the organizations do with their personal data.
Organizations must actively provide this information to individuals in a way
that is easy to access, read and understand.
When an organization collect personal data from the
individual it relates to, or personal data is collected from a source other
than the individual it relates to it must provide them with privacy information
at the time their data is collected as per below:
- · Within a reasonable period of obtaining the personal data and no later than a month;
- · If organization use data to communicate with the individual, at the latest, when the first communication takes place; or
- · If organizations envisage disclosure to someone else, at the latest, when they disclose the data.
Organizations must actively provide privacy information to
individuals. Organizations can meet this requirement by putting the information
on company’s website, but must make individuals aware of it and give them an
easy way to access it.
When obtaining personal data from other sources, organizations
do not need to provide individuals with privacy information if:
- · the individual already has the information;
- · providing the information to the individual would be impossible;
- · providing the information to the individual would involve a disproportionate effort;
- · providing the information to the individual would render impossible or seriously impair the achievement of the objectives of the processing;
- · organizations are required by law to obtain or disclose the personal data; or
- · organizations are subject to an obligation of professional secrecy regulated by law that covers the personal data.
Individual Rights on Privacy
The GDPR is more specific about the information you need to
provide to people about that what the organizations do with the personal data.
I have summarized some of the key elements of the individual’s right on privacy
to understand it concisely. The GDPR provides the following rights for
individuals:
The Right to be Informed
The right to be informed covers some of the key transparency
requirement of the GDPR. It is about providing individuals with clear and
concise information about their personal data collection and uses. Article 13
and 14 of the GDPR specify what individuals have the right to be informed
about. Below are some of the points:
- · Individual have the right to be informed about the collection and use of their personal data. This is the key transparency requirement under the GDPR.
- · Organizations must provide individuals with ‘privacy information’ including purpose for processing personal data, retention period of that personal data, and who it will be shared with.
- · Organizations must provide privacy information to individuals at the time of collection of their personal data from them.
- · If the organizations collect personal data from other sources (such as publicly accessible sources), they must provide individuals with privacy information with a reasonable period and no later than a month.
- · Organizations must provide privacy information to individuals which is concise, transparent, intelligible, easily accessible, and must use clear and plain language.
- · Organizations must regularly review, and where necessary, update the privacy information. They must bring any new uses of an individual’s personal data to their attention before you start the processing.
- · If organizations apply AI (Artificial Intelligence) to personal data, must be upfront about it and explain your purposes for using AI.
The Right of Access
The right of access gives individuals the right to obtain a
copy of their personal data as well as other supplementary information. It helps
individuals to understand how and why they are using their data and check that
they are doing it lawfully. An individual is entitled to:
- · Get confirmation that the organization is processing their personal data
- · Get a copy of their personal data and other supplementary information
- · Organizations have one-month time to respond to the request and cannot charge a fee in most of the circumstances
In addition to a copy of their personal data, organizations
also have to provide individuals with the following information:
- · The purpose of data processing
- · The categories of personal data concerned
- · The recipients or categories of recipient organization disclose the personal data to
- · Retention period for sorting the personal data or, where this is not possible, the criteria for determining how long data will be stored
- · The existence of individuals rights to request rectification, erasure or restriction or to object to such processing
- · The right to file a complaint with the supervisory authority
- · Information about the source of the data, where it was not obtained directly from the individual
- · The existence of automated decision-making (including profiling)
- · The safeguards organization provide if personal data is transferred to a third country or international organization
The Right to Rectification
Under Article 16 of the DGPR, individuals have the right to
have inaccurate or misleading personal data be rectified. Although
organizations may have already taken steps to ensure that the personal data was
accurate when they collected it, this right imposes a specific obligation to
reconsider the accuracy upon request.
- · An individual can make a request for rectification verbally or in writing
- · An individual has a right to have inaccurate personal data be rectified, or completed if it is incomplete.
- · Organizations have one calendar month to respond to a request
Organizations can refuse to comply with request for
rectification if they consider that a request is manifestly unfounded or
excessive, considering whether the request if repetitive in nature. In such
case organization can request a ‘reasonable fee’ to deal with the request; or
refuse to deal with the request.
The GDPR does not give a definition of the term accuracy.
However, the Data Protection Act 2018 (DPA 2018) states that personal data is
inaccurate if it is incorrect or misleading as to any matter of fact.
The Right to Erasure
Under the Article 17 of the GDPR, individuals have the right
to have personal data erased. This is also known as the ‘Right to be
Forgotten’. This right is not absolute and only applies in certain
circumstances.
- · The personal data is no longer necessary for the purpose for which the organizations originally collected.
- · Organizations are replying on consent as their lawful basis for holding the data, and the individuals withdraw their consent
- · An individual object to processing their data, and there is no overriding legitimate interest to continue this processing
- · Organizations are processing the personal data for direct marketing purposes and the individual objects to that processing
- · Organizations are processing the data unlawfully
There is an emphasis on the right to have personal data
erased if the request related to data collected from the children. This
reflects the enhanced protection of children’s information, especially in
online environments, under the GDPR.
If organization process data collected from children, they
should provide particular weight to any request for erasure if the processing
of data is based upon consent given by a child especially any data processing
of their personal data on the internet. This is still the case when the data
subject is no longer a child, because a child may not have been fully aware of
the risks involved in the processing at the time of consent.
The Right to Restrict Processing
Under Article 18 of the GDPR, individuals have right to
restrict the processing of their personal data where they have a reason for
wanting the restriction. This maybe because they have issue with the content of
the information, an organization hold. Individual have the right to request the
organization to restrict the processing of their personal data in the following
circumstances:
- · Individual contests the accuracy of their personal data and organization are verifying the accuracy of the data
- · The data has been unlawfully processed and the individual opposes erasure and request restriction instead
- · The individual has objected to organization their data under Article 21(1), and organizations are considering whether their legitimate grounds override those of the individual
- · If an individual has challenged the accuracy of their data and asked organization to rectify it, they also have a right t request to restrict the processing while rectification request is pending
- · an individual exercise their right to object under Article 21(1), they also have a right to request to restrict the processing, while their objection request is under consideration
- · Individual have the right to request the restriction or suppression of their personal data
- · When processing is restricted, organizations are permitted to store the personal data but not use it
- · An individual can make a request for restriction verbally or in writing
Organizations must not process the restricted data in any
way except to store it unless:
- · Organizations have the individual’s consent
- · It is for the establishment, exercise or defense of legal claims
- · It is for the protection of the rights of another person
- · It is for reasons of important public interest
Organizations must inform the individual before listing the
restriction.
The Right to Data Portability
The right to data portability gives individuals the right to
receive personal data they have provided to a controller in a structured,
commonly used and machine-readable format. It also gives them the right to
request that a controller transmits this data directly to another controller.
- · The right to data portability allows individual to obtain and reuse their personal data for their own purposes across different services
- · It allows individuals to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability
- · The right only applies to information an individual has provided to a controller
- · This enables individuals to take advantage of applications and services that can use this data to find them a better deal or help them understand their spending habits
The right to data portability only applied when:
organization’s lawful basis for processing this information is consent or the
performance of a contract; and organizations are carrying out the processing by
automated means.
The Right to Object
Under Article 21 of the GDPR, individuals have the right to
object to the processing of their personal data. This effectively allows
individuals to ask you to stop processing their personal data. Individuals have
the absolute right to object to processing of their personal data if it is for
direct marketing purposes. Individuals can also object if the processing is
for:
- · A task carried out in the public interest
- · The exercise of official authority vested in organization
- · Organization’s legitimate interests or those of a third party
The right to object only applies in certain circumstances.
Whether it applies depends on organization’s purposes for processing and its
lawful basis for processing.
If the organizations are processing data for scientific or
historical research, or statistical purposes, the right to object is more
limited.
Rights in relation to Automated decision-making and Profiling
Organizations obtain personal information about individuals
from a variety of different sources. Internet searches, buying habits,
lifestyle and behavior data gathering from mobile phones, social networks,
video surveillance systems and the Internet of Things are examples of the types
of data organizations might collect.
The GDPR has provisions on:
- · Automated individual decision-making (making a decision solely by automated means without any human involvement)
- · Profiling (automated processing of personal data evaluates certain things about an individual). Profiling can be part of an automated decision-making process.
The GDPR applies to all automated individual decision-making
and profiling. Article 22 of the GDPR has additional rules to protect
individuals if organizations are carrying out solely automated decision-making
that has legal or similarly significant effect on them
Organizations can only carry out this types of
decision-making where the decision is:
- · Necessary for the entry into or performance of a contract; or
- · Automated by Union or Member state law applicable to the controller: or
- · Based on the individual’s explicit consent
Organizations must identity whether any of their processing
falls under Article 22 and, if so, make sure that they:
- · Give individuals information about the processing;
- · Introduce simple ways for them to request human intervention or challenge a decision;
- · Carry out regular checks to make sure that organization’s systems are working as intended.
Automated individual decision-making and profiling can lead
to quicker and more consistent decisions. But if they are used irresponsibly
there are significant risks for individuals. The GDPR provisions are designed
to address these risks.
References: