The Regulation gives everyone rights against organisations that process data about them. As an employee you have these rights yourself, and you may be the first person to receive a request from a customer or colleague.
The rights
- Information (Articles 13 and 14): to be told how the data is used.
- Access (Article 15): to find out whether the organisation processes data about you, get a copy, and be told the purposes, recipients and storage period.
- Rectification (Article 16): inaccurate data must be corrected, and incomplete data can be completed.
- Erasure (Article 17, the "right to be forgotten"): in certain cases, for example when the data is no longer needed or consent has been withdrawn. The right is not absolute. If the law requires the organisation to keep the data, erasure does not apply.
- Restriction (Article 18): the data is stored but not used further while a dispute is being resolved.
- Data portability (Article 20): to receive data you yourself have provided, in a commonly used machine-readable format. Applies to automated processing based on consent or contract.
- Objection (Article 21): to processing based on legitimate interests or a public task, and always to direct marketing.
- Automated decisions (Article 22): the right not to be subject to a decision based solely on automated processing, including profiling, if it has legal or similarly significant effects. There are exceptions, for example when the decision is necessary for a contract or is based on explicit consent. In that case you have, as a main rule, the right to have a human assess the matter, to express your view and to contest the decision.
The deadline: one month
The organisation must reply without undue delay and at the latest within one month of receiving the request (Article 12(3)). The deadline can be extended by a further two months if the request is complex or there are many requests, but the person must then be told within the first month, with reasons.
The main rule is that the reply is free of charge. The organisation can charge a reasonable fee or refuse only if the request is manifestly unfounded or excessive.
What do you do if you receive a request?
A request does not need to use particular words. If a customer writes "I want to see what you have stored about me" or "delete me", that is a rights request.
- Do not ignore it. The deadline runs from the day the organisation receives the request, even when it lands with you.
- Pass it on at once to the person responsible for data protection or to the function the organisation has designated, and write down the date you received it.
- Do not hand over anything yourself unless you have been told to. Who is asking must be established first.
- Do not promise anything you cannot stand behind, such as deleting everything.
Checking identity
The organisation must make sure the right person is asking. Otherwise a fraudster could get access to other people's data, and that is a breach in itself. If you cannot be sure, the organisation can ask for the additional information necessary to confirm identity. The customer should not have to send more than necessary, and a national identity number should normally not be required.
When other people's data is in the document
The right of access must not harm the rights of others. If a document contains information about other people, it often has to be redacted before the copy is sent out. This is done by the people responsible in the organisation, not by the individual caseworker on their own.
Complaint to Datatilsynet
If the organisation has not replied or has refused without good reason, the person can complain to Datatilsynet. As a main rule, decisions by Datatilsynet can be appealed to the Privacy Appeals Board (Personvernnemnda, § 22 of the Personal Data Act). The person can also go to the courts and claim compensation (lesson 9).