This chapter establishes the individual rights that data subjects can exercise in relation to their personal data. It sets out the procedures for transparent communication with data subjects and defines their rights to access, rectification, erasure, restriction, data portability, objection, and protection against automated decision-making. These rights are fundamental to empowering individuals to control their personal information.
Overview
Chapter III: Rights of the Data Subject
Chapter III empowers individuals with a comprehensive set of rights to control and protect their personal data. These rights are enforceable and must be facilitated by controllers through appropriate procedures and mechanisms.
Transparency Obligations (Articles 12-14):
Controllers must provide clear, concise, and easily accessible information to data subjects about data processing activities. This includes details about the controller's identity, purposes of processing, legal basis, recipients of data, retention periods, and data subject rights. Information must be provided at the time of data collection, whether obtained directly from the data subject or from other sources.
Individual Rights:
- Right of Access (Article 15): Data subjects can obtain confirmation of whether their personal data is being processed and access to that data, along with supplementary information about the processing.
- Right to Rectification (Article 16): Individuals can request correction of inaccurate personal data and completion of incomplete data.
- Right to Erasure - 'Right to be Forgotten' (Article 17): Data subjects can request deletion of their personal data under certain circumstances, such as when data is no longer necessary, consent is withdrawn, or processing is unlawful.
- Right to Restriction of Processing (Article 18): Individuals can request limitation of processing when accuracy is contested, processing is unlawful but they don't want erasure, or when they need the data for legal claims.
- Right to Data Portability (Article 20): Data subjects can receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller without hindrance.
- Right to Object (Article 21): Individuals can object to processing based on legitimate interests, direct marketing (absolute right), or for scientific/historical research purposes.
- Rights Related to Automated Decision-Making (Article 22): Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal or similarly significant effects.
Response Requirements:
Controllers must respond to data subject requests without undue delay and within one month of receipt, with possible extensions of two additional months for complex requests. All responses must be provided free of charge unless requests are manifestly unfounded or excessive.
Restrictions (Article 23):
EU or Member State law may restrict the scope of certain rights and obligations when necessary for important objectives such as national security, defense, public security, prevention and investigation of crimes, or protection of data subject or rights of others.