People whose information a company holds have rights under Articles 12-22 of the General Data Protection Regulation. It is often front-line employees who hear about them first: on the telephone, in the shop or in an email. You therefore need to know the rights and what to do when someone uses them.
The rights
- Information (Articles 13 and 14): The person must know who is processing the information, why, for how long, and what rights they have. This normally happens in a privacy notice.
- Access (Article 15): The person can find out whether the company processes information about them, and obtain a copy of it and certain information about the processing. The right must not infringe other people's rights; for example, you must not hand over information about another person.
- Rectification (Article 16): Incorrect information must be corrected.
- Erasure (Article 17), also called "the right to be forgotten": Information must be deleted, for example if it is no longer necessary or consent has been withdrawn. The right does not apply if the law requires the company to keep it.
- Restriction (Article 18): The information may only be stored and not used, for example while a dispute about its accuracy is being settled.
- Data portability (Article 20): The person can obtain their own information in a common, machine-readable format and move it, if the processing is based on consent or contract and is carried out automatically.
- Objection (Article 21): The person can object to processing based on legitimate interest or the public interest. Against direct marketing the right is absolute: the company must then stop.
- Automated decisions (Article 22): The person has, as a starting point, the right not to be subject to a decision based solely on automated processing, for example profiling, when it has legal or similarly significant effects.
The deadline
The company must respond without undue delay and at the latest within one month of receiving the request. The deadline can be extended by two further months if the request is complex or there are many requests. The person must then be told of the extension and the reason within the first month (Article 12(3)). The response is, as a starting point, free of charge.
If the company cannot comply with the request, it must tell the person why, and that they can complain to Datatilsynet and bring the matter before the courts.
What do you do if someone asks for something?
- Do not stop, and do not turn the person away. A request can come in any form, including orally or in a customer email. It does not have to mention GDPR.
- Pass it on immediately to the person or function responsible for requests where you work. The deadline runs from receipt.
- Do not hand out information yourself before the identity has been checked. Otherwise you risk giving information to the wrong person. The company may ask for the information necessary to confirm identity.
- Do not delete or change the information to make it look tidy after access has been requested. It is unlawful to change it to hide something.
Complaints and compensation
The person can complain to Datatilsynet (Article 77). A person who has suffered damage has the right to compensation (Article 82). It is the courts that decide.
Remember: The one-month deadline keeps running, even while the request is sitting in your inbox.