Skip to 0 minutes and 9 seconds It is now the right moment to closely investigate some of the rights of data subjects with regard to the processing of their personal data. We will start with the right of access and the right to rectification. The first significant right that data subjects have under the General Data Protection Regulation is the right of access. In this respect, data subjects have the right to obtain from data controllers a confirmation regarding the fact whether or not personal data in relation to them are being processed. When this is indeed the case, they may access those personal data. In addition, they can access such relevant types of information as, first, the purposes of the processing, second, the categories of personal data in question.
Skip to 0 minutes and 57 seconds Third, the recipients or categories of recipient to whom the personal data have been or will be disclosed such as recipients in third countries or international organisations. Fourth, if it is possible, the period for which controllers are planning to store the personal data or if it is not possible, the criteria used to determine that period. Fifth, the existence of the right to request from the controller rectification or erasure of personal data or restriction of the processing of personal data concerning the data subject or to object to such processing. Sixth, the right to lodge a complaint with a supervisory authority. Seventh, if the personal data are not collected from the data subject, any available information as to its source.
Skip to 1 minute and 46 seconds And, eighth, the existence of automated decision-making, including profiling and at least meaningful information in these cases about the logic involved, the significance of this processing for the data subject, and the envisaged consequences. For example, an app developer for the Android platform may turn to Google, that can be considered a data controller, and request a confirmation from Google whether it processes her personal data. Importantly, she may ask to access these data and to be informed about the purposes of the processing and recipients of this information. When data subjects exercise their right of access, controllers are required to provide a copy of the personal data that are being processed.
Skip to 2 minutes and 29 seconds If the request from the data subject has been made by electronic means, information is provided to him or her in the commonly used electronic form unless he or she specifically requests otherwise. For any additional copy of the personal data, controllers may charge a reasonable fee on the basis of administrative costs. Importantly, this right to obtain a copy may not adversely affect the rights and freedoms of others.
Skip to 2 minutes and 57 seconds In addition, the GDPR contains another essential right that cannot be disregarded. This is the right to rectification. If controllers store personal data of individuals, the latter are further entitled to the right to rectify, without any undue delay, inaccurate information concerning them. Considering the purpose of the processing, any data subject has the right to have his or her personal data completed such as, for instance, by providing a supplementary statement. Imagine that our app developer has learned that her personal data are being processed by Google. In addition, she discovers that the last name is not correctly spelled and that the address details are outdated. She can then make use of the right to rectification and modify any information that is incorrect.
Skip to 3 minutes and 47 seconds We have just looked into the right of access and the right to rectification that all data subjects have under the General Data Protection Regulation. It is crucial to be aware of these rights and make use of them when necessary.
Right of access and right to rectification
This video is focused on two essential rights with regard to accessing personal data and rectifying them.
Under the GDPR, data subjects have the right to obtain from data controllers a confirmation regarding the fact whether or not personal data in relation to them are being processed and to access these data. This is the so-called right of access found in Article 15 GDPR. For example, an Android app developer may request from Google as a data controller a confirmation whether it processes her personal data, access these data and be informed about the purposes of the processing and recipients of the data. Data subjects can access such information as the purposes of the processing, the categories of personal data in question and the recipients or categories of recipient of personal data. If you are interested to know what types of data were revealed to Max Schrems by Facebook after he had made use of his right of access, please visit this website.
The following right is the right to rectification that has been laid down in Article 16 GDPR allowing data subjects to rectify without any undue delay their inaccurate personal data. These data can be completed, for instance, by providing a supplementary statement. If the Android app developer discovers that her last name is not correctly spelled in her personal data stored by Google, she can invoke the right to rectification and modify this information.
You would probably agree that these rights cannot be disregarded, wouldn’t you?
© University of Groningen