Under Articles 12 to 22 GDPR, people have a number of rights. A customer, a job applicant, a pupil or a colleague may exercise a right at your company. You are often the first to hear about it, because it arrives by e-mail, by phone or at the counter.
The rights
- Information (Articles 13 and 14): who processes the data, why, for how long and what rights the person has. Usually in the form of a notice about processing.
- Access (Article 15): a person has the right to find out whether their data is processed and to receive a copy and further information. The first copy is free. The rights of others must not be affected, so data of third parties is not disclosed.
- Rectification (Article 16): inaccurate data is corrected and incomplete data is completed.
- Erasure (Article 17), the "right to be forgotten": data is erased, for example, when it is no longer needed or when the person has withdrawn consent. It does not apply if the controller must keep the data by law.
- Restriction of processing (Article 18): the data is only stored, for example while its accuracy is being examined.
- Data portability (Article 20): for processing based on consent or contract and carried out by automated means, a person may receive the data in a structured, commonly used format.
- Objection (Article 21): a person may object to processing based on legitimate interest and to direct marketing. Processing for marketing must always stop.
- Automated decision-making (Article 22): a person has the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on them.
The deadline: one month
The controller must respond to a request without undue delay and at the latest within one month of receiving it. The deadline can be extended by two further months where necessary, taking into account the complexity and number of requests. The person is informed of the extension within one month, together with the reasons (Article 12(3)). The deadline runs from the delivery of the request to the controller. In practice this applies even if the request is received by any employee, not only the responsible person.
What you should do
- Recognise the request. It does not need to contain the words "GDPR" or "Article 15". "I want to know what you have on me" or "delete me from the database" is enough.
- Do not deal with it yourself unless you have been instructed to. Pass it on immediately to the designated person, the data protection officer or your supervisor according to the internal rules. Note when the request arrived.
- Verify identity. The controller must be sure that the data goes to the person it concerns. Otherwise it could hand data to a fraudster. If in doubt, it may ask for additional information.
- Do not promise erasure or disclosure. That is decided by the controller, who assesses the exceptions.
Requests are generally free of charge. If a request is manifestly unfounded or excessive, for example because it is repeated, the controller may charge a reasonable fee or refuse it. A refusal must be reasoned and must explain the possibility of lodging a complaint.
Complaint to the Office
If a person is not satisfied, they may lodge a complaint with the Office for Personal Data Protection (Article 77 GDPR) or turn to a court. Under Article 82, anyone who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to compensation.
Telephone and counter
When a caller wants information about another person, for example "does Mr Novák work for you?", do not give it without verification. Always first check who you are talking to and why they want to know. If in doubt, offer to call back.
What to remember
- A request does not have to be called "under the GDPR". It is enough that it is clear.
- The deadline is one month, exceptionally up to three months in total.
- Pass the request on immediately according to the internal rules.
- Verify identity before releasing data.