One of the leading motifs for the GDPR to be developed is to provide more rights to the data subjects. Understanding the data subject rights that, as defined by the regulation, provides access to the personal data, rectification, right to object, right to erasure or popularly called right to be forgotten, right to data portability, right to restrict processing of the data and right not to be subject to profiling and automated decision making. Compared to the period before GDPR came into force, the rights provided are massive step further in giving the individuals better control over their personal data.
However, are all these rights fully applicable or there are exceptions or maybe scenarios where individuals can practice their rights only partly?
The simple answer to that would be, every single individual has a right to exercise their rights. The more complex answer would be, depends on the purpose of their data processing, meaning, every single organisation before started to process their personal data should have defined the purpose for the processing. And the purposes differ! The processing could be based on a consent, legal basis (excluding the contractual duties) contract basis, vital interest, public interest or legitimate interest. Simple a?! We will continue with the purposes in a different paper.
Let’s focus now on the purposes from individuals’ point of view and how they affect the rights when exercised in a particular scenario.
Consent, that should be provided before the processing began, should be freely given, specific, well informed, unambiguous and easy to withdraw. In practical terms that means that the consent should be given for certain marketing activities for example, sent via email. If the individual consented the emails communication the organisation should not be providing any marketing information over the phone. If after a while the emails got to much the consent could be withdrawn. For the same purpose individuals can exercise the right to update their details, rectification, to object and restrict the processing, simply they can exercise all their rights. And the organisation must respond to their request as per the regulation, within one month.
Most often experienced issues of the marketing consent is when consent refers to third party organisations as well. Often, it happens that certain organisation calls us and we do not know that we have ever heard of the organisation far form providing consent for certain personal data processing. Therefore, carefully when providing consent for marketing communication, although it is simple to withdraw the consent, it can cause few disturbing telephone calls or unwanted text messages.
When organisations process our personal data based on legal obligation, we can exercise only some of the rights. For example, home office would process certain personal data and we cannot ask them to forget us. Obviously! We cannot object the processing nor to exercise the data portability right. Where we could possibly take the data? We can still ask them to rectify our data, and to provide us with access to the data. Processing personal data based on legal obligation usually goes with application of other pieces of legislation for example Equality Act, Human Rights and Freedom of Information Act.
Contractual obligation is the purpose of processing which defines obligations between two or more parties, employment contract or contract for buying certain services, mobile provider for example. GDPR defines how the individuals can exercise their rights, however they are not “hard rules” in all the scenarios. In simple terms all of the rights could be applied excluding objecting the processing. The contractual obligation most of the time goes with application of other regulations like Employment act or all of the taxing obligations acts. Also, retention of certain employees’ personal data is predefined in order to support, potentially, legal claims, individuals’ taxing and pension data.
If an organisation collected data for vital interest that means that they were doing that to provide urgent medical treatment, a disaster response event or in case when the individual was not able to provide consent for. All the rights are applicable excluding the right to portability and right to object. The data erasure may be also subject to the Records Management Code of Practice or maintained as long as the circumstances require the processing.
If personal data is processed data in public interest, like NHS, educational institutions or public authorities, individuals have all the rights excluding right to portability and right to erasure. NHS would not erase the personal data and the health records as they, firstly, relate to the entire health condition of the individual current and future treatments, employment status, insurance obligations and secondly all the records must be handled in accordance with the Records Management Code of Practice developed by NHS and some other pieces of legislation like Common Law Duty of Confidentiality, Equality act, Data Protection Act etc.
Lastly, individuals can exercise all the rights when the personal data processing is based on legitimate interest excluding the right to portability. For example, banks may rely on the legitimate interest for processing large amount of data like IP address, transactions history and behavioural analytics in order to prevent fraud while maintaining all the rights as GDPR defines them.
Additionally, each of the basis for processing personal data provided the right not to be subject to automated decision making and profiling which was replaced by the Data Usage and Act 2025, which states that organisation can make automated decision making as long as the processing can be defined as legitimate interest. Although certain flexibility is given to the organisations, individuals can still ask the organisation for human input over the automated decision.
Awareness about own personal data, the organisations that collect and process personal data, some understanding of why data is processed and certainly understanding of the rights given to all individuals may help prevention of many unpleasant or frustrating events. Individuals, both, the ones who deal with the data and the ones who give their personal data are the biggest contributors to data protection in overall terms. Strengthening the application of the rules will certainly create more trust between the actors, better security and safer environment.
