Data Subjects' rights Flashcards
What are the relevant time windows for responding to a Data subject request?
Article 12(3) : 1 month, starting with receipt of the request, should be the normal time frame, which can be extended by two for the month for cases of of specific situations and especially complex request.
During the first month, however, the organization has to decide whether it can act on the users request at all. If the organization decides not to proceed it must inform the data subjects about this and even advise them as to any opportunities to lodge complaints with regulators.
What is the right to be forgotten?
Article 17(1): Data subjects obtain the right to have their personal data erased if:
(A) The data is no longer needed for its original purpose and no new lawful purpose exists
(B) The lawful basis for the processing is the data subject is concerned, the data subject with drawls the consent, and no other lawful ground exists
(C) The data subject exercises the right to object, and the controller has no overriding grounds for continuing this processing
(D) The data has been processed unlawfully
(E) Erasure is necessary for compliance with EU law or the national law of the relevant member state
What are the exemptions to the rights of erasure in article 17(3)?
Where processing is necessary:
- for exercising the right of freedom of expression and information
- for compliance with a legal obligation or for the performance of a task carried out in the public interest
- for the establishment of, exercise of or defence against legal claims.
When do data subjects have the right to restrict the processing of the personal data under article 18 of the GDPR?
- The accuracy of the data is contested (and only for as long as it takes to verify that accuracy)
– the processing is unlawful, and the data subject requests restriction;
– the controller no longer needs the data for the original purpose, but the data is still required by the controller to establish, exercise or defend legal rights; or
– verification of overriding grounds pending in the context of an erasure request
What are the limitations for the right to object where personal data is processed for scientific and historical research purposes or statistical purposes?
Article 21(6) states that the right to object exists only as far as the processing is not considered necessary for the performance of the task carried out for reasons of public interest
What is the right not to be subject to automated decision-making?
Article 22 has a narrow application. The right not to be subject to automated decision-making applies only if such position is based solely on automated decision- making processing and produces legal effects concerning the data subject or similarly significantly affects them.
