The GDPR gives people, the data subjects, specific rights over their data. Any employee may come across a request, for example at the counter, on the phone or in an e-mail. You must be able to recognise it and pass it straight to whoever has to deal with it.
The main rights (Articles 15–22 GDPR)
- Access (Article 15): to know whether data is being processed, to obtain a copy and to learn the purposes, recipients and duration.
- Rectification (Article 16): to have wrong data corrected or completed.
- Erasure, the so-called "right to be forgotten" (Article 17): to have data deleted in certain cases, for example when it is no longer needed or when consent is withdrawn. It is not absolute: data that the law requires to be kept must be kept.
- Restriction (Article 18): to ask that the data only be stored, for example while its accuracy is checked.
- Portability (Article 20): to receive in a structured format the data provided, when the processing is based on consent or on a contract and is automated.
- Objection (Article 21): to object to processing based on legitimate interest or public interest, and always to direct marketing.
- Not to be subject to decisions based solely on automated processing with significant effects (Article 22).
There is also the right to withdraw consent at any time (Article 7).
The one-month deadline
The controller must reply without undue delay and at the latest within one month of receiving the request. In complex cases the deadline can be extended by a further two months, but the person must be told of the extension within the first month (Article 12(3)). As a rule the reply is free of charge.
The month starts from the moment the company receives the request, even if it reached only one employee. That is why the speed with which you pass it on matters.
How to recognise a request
No special wording and no form are needed. The person may ask:
- "I want to know what data you hold about me."
- "Delete my number from your list."
- "I don't want to receive your offers any more."
- "There is a mistake in my address, please correct it."
It may arrive by e-mail, by post, by phone, on social media or at the counter. If a sentence sounds like a request about data, treat it as one.
What you do
- Listen and note down: who they are, what they are asking, when and how they asked.
- Do not answer on the substance yourself and do not promise timescales. Do not give data over the phone to someone you do not know.
- Forward it at once to the privacy contact, the DPO or the person named by the company.
- Do not delete or change data "to settle it quickly": a deletion outside the procedure can destroy what the law requires to be kept.
Checking identity
Before giving data to someone who asks for it, you must be sure they really are the data subject (Article 12(6)). Giving a copy of the data to someone pretending to be someone else is a personal data breach. The controller may ask for the information needed to confirm identity, but only that.
Other people's data
The right of access concerns the person's own data. You must not reveal other people's data: for example, in a copy of an internal document the names of third parties must be blacked out unless there is a reason not to. The controller decides, not you.
Complaint and compensation
Anyone who believes their rights have been infringed can lodge a complaint with the Garante (Article 77 GDPR) or go to court (Article 79) and can claim compensation for damage (Article 82). A slow or rude reply to a simple request can give rise to a complaint.