People have rights over their data, and you may receive a request when you least expect it: in a shop, in a school, in human resources or by email. Knowing how to recognise one and passing it on in time avoids fines.
The rights
- Access (article 15 of the GDPR): finding out whether their data is processed and getting a copy, together with information about the processing.
- Rectification (article 16): correcting inaccurate data or completing incomplete data.
- Erasure (article 17): asking for data to be deleted when it is no longer needed, when consent is withdrawn or when it was processed unlawfully. It is not an absolute right: the company may keep data that a law requires it to keep.
- Objection (article 21): objecting to processing based on legitimate interest or a public-interest task, and at any time to advertising (direct marketing).
- Portability (article 20): receiving their data in a structured, commonly used format, when the processing is based on consent or a contract and is automated.
- Restriction (article 18): asking for data to be kept but not used, for example while its accuracy is being checked.
There is also the right not to be subject to decisions based solely on automated processing with significant effects (article 22).
The deadline: one month
The controller must reply within one month at the latest of receiving the request (article 12.3 of the GDPR). If it is complex or there are many, the period can be extended by a further two months, but the person must be told about the delay and the reasons within the first month.
Dealing with a right is free of charge. A reasonable fee can be charged, or the controller can refuse to act, only if requests are manifestly unfounded or excessive, and the company must be able to justify it.
What to do if you receive a request
- Recognise it. The person does not have to mention a law or use a form. Phrases like "I want to know what data you hold about me" or "delete my data" are already a request.
- Do not ignore it or leave it in your inbox. The clock starts when the company receives it, even if it was you who received it.
- Pass it on immediately to the person or department your company has designated, or to the data protection officer if there is one.
- Do not reply on your own, and do not hand data to someone who asks for it by phone before their identity has been checked.
Checking identity
Before data is handed over, you must be sure that whoever asks is really the data subject. If there are reasonable doubts, the company can ask for additional information to confirm it (article 12.6). It is one of the most common ways data leaks: someone pretends to be another person and asks for their data.
The complaint to the AEPD
If the company does not reply, replies badly or replies late, the person can lodge a complaint with the Spanish Data Protection Agency (article 77 of the GDPR and the LOPDGDD) and go to court. The AEPD can order the right to be honoured and fine whoever failed to do so.
Remember: where rights are concerned, the clock runs from the moment someone in the company receives the request. Forward it the same day.