GDPR · Domain 2
Data Subject Rights
About 20% of the exam
The rights in one table
- Articles 13 and 14
- information when data is collected
- Article 15, access
- confirmation, a copy and context
- Article 16, rectification
- correct and complete the record
- Article 17, erasure
- delete when a ground applies
- Article 18, restriction
- store it, stop using it
- Article 20, portability
- take it to another controller
- Article 21, objection
- stop unless compelling grounds exist
- Article 22
- challenge a solely automated decision
The response clock
- Standard deadline
- one month from receipt
- Extension
- two further months when complex
- Telling the person
- inside the first month, with reasons
- Cost
- free unless excessive or repetitive
- Identity doubt
- ask only for what you need
- Refusal
- explain why and mention remedies
- Format
- electronic request, electronic answer
The clock starts when the request arrives, not when the identity check finishes, so slow verification eats into your own month
Right of access
- Confirmation that processing is happening
- A copy of the personal data
- Purposes, recipients and retention period
- Source of data collected elsewhere
- Named recipients, not just categories
- Third party privacy may justify redaction
- One copy free, further copies chargeable
Grounds for erasure
- Data no longer needed for purpose
- Consent withdrawn with no other basis
- Objection upheld against legitimate interests
- Processing was unlawful from the start
- A legal obligation requires deletion
- Collected from a child online
When erasure fails
- Freedom of expression and information
- Compliance with a legal obligation
- Public health or public interest tasks
- Archiving, research or statistical purposes
- Establishing or defending legal claims
- Backups cleared on the next cycle
Portability limits
- Only consent or contract based processing
- Only automated processing, never paper files
- Provided and observed data, not inferred
- Structured, commonly used, machine readable format
- Direct transfer where technically feasible
- Other people's rights must survive
Objection and automated decisions
Objection, Article 21
- Absolute for direct marketing
- Grounds needed against legitimate interests
- Controller must show compelling grounds
- Flagged separately in every notice
Automated decisions, Article 22
- Solely automated with significant effect
- Allowed by contract, law or consent
- Human intervention must be available
- Meaningful information about the logic
A human who rubber stamps the model output does not make the decision anything less than solely automated
Handling a request, step by step
- Log it and start the clock
- Confirm who is asking
- Search every system and backup
- Decide which exemptions apply
- Redact other people's data
- Answer in plain language
- Record what you sent and why
- Requests can arrive on any channel
- No particular form or wording required
- A request to any staff member counts
- Refusals must mention complaint and court routes
Restriction of processing
- Accuracy contested while you verify
- Unlawful processing where erasure is refused
- Data kept only for legal claims
- Objection pending the balancing outcome
- Store it, do not otherwise use it
- Tell the person before lifting restriction
Rectification in practice
- Correct inaccurate data without undue delay
- Complete incomplete records as well
- Clinical opinions are not simply overwritten
- Notify recipients unless it proves impossible
- Fix the upstream source too
Rights mistakes that cost fines
- Charging a fee for a first copy
- Demanding a passport for a simple query
- Ignoring requests made through social media
- Treating marketing objections as preferences
- Missing the month with no extension notice
- Deleting data instead of restricting it
Rapid recall: rights by article
- Article 12
- transparency and how to respond
- Article 13
- notice for data collected directly
- Article 14
- notice for data from elsewhere
- Article 15
- the right of access
- Article 19
- notify recipients of changes
- Article 21
- the right to object
- Article 23
- national restrictions on rights
Case law worth naming
- Google Spain
- delisting from search results
- Google against CNIL
- delisting is European, not global
- Nowak
- opinions about a person count
- Austrian Post
- recipients must be named individually
- Breyer
- dynamic addresses can identify people
Notices under Articles 13 and 14
- Identity and contact details of controller
- Contact details for the protection officer
- Purposes and the lawful basis claimed
- Named legitimate interests where relied upon
- Recipients and any transfers abroad
- Retention period or the criteria used
- The rights available and how to complain
- Whether providing the data is required
Data obtained from someone else needs the notice within a month, or at first contact with the person if that comes sooner
Reference strip: clock, access, erasure, portability, objection
Clock
- One month from receipt
- Two extra months when complex
- Tell people inside month one
Access
- One copy free of charge
- Purposes, recipients, retention, rights
- Redact other people carefully
Erasure
- Six grounds, five exceptions
- Expression and legal claims survive
- Backups cleared next cycle
Portability
- Consent or contract only
- Automated processing only
- Provided and observed, not inferred
Objection
- Marketing objection is absolute
- Otherwise weigh compelling grounds
- Flag the right separately
Quick exam traps
- Trap: Every data subject request must be answered within seventy two hours
- Trap: The right to erasure means data must always be deleted on request
- Trap: Data portability applies whatever the lawful basis
- Trap: A controller may charge a standard administration fee for access requests
- Trap: A request only counts when it reaches the privacy team in writing
- Trap: Any human glance at an automated output removes Article 22 entirely
- Trap: A marketing objection can be refused if the interest is compelling
cybercertprep.com · original revision sheet written from the public body of knowledge