People whose data is processed have rights. The worker is the data subject of their own data, and is also often the one who receives requests from customers, users or colleagues. That is why it matters to know the rights and what to do when someone exercises them.
The main rights
- Information (Articles 13 and 14 of the GDPR): to know who processes the data, why, for how long and to whom it is disclosed.
- Access (Article 15): to know whether data about you is being processed and to obtain a copy of it, with information about the processing.
- Rectification (Article 16): to correct inaccurate data or complete incomplete data.
- Erasure (Article 17): to ask for data to be erased in certain situations, for example when it is no longer necessary.
- Restriction of processing (Article 18): to suspend the use of the data while a dispute is being resolved.
- Portability (Article 20): to receive the data you provided in a structured format and, if you wish, transmit it to another controller. Lei n.º 58/2019 (Article 18) limits it to data provided by the data subject.
- Objection (Article 21): to object to processing under certain conditions, for example to direct marketing.
- The right not to be subject to automated decisions with significant effects (Article 22).
Some rights have limits. If a law imposes a retention period, erasure can only be exercised after it (Article 21(5) of Lei n.º 58/2019).
Deadlines and costs
- The controller replies without undue delay and at the latest within one month of receiving the request (Article 12(3) of the GDPR).
- That period may be extended by two further months if the request is complex or there are many requests. The data subject is told of the extension and the reasons within the first month.
- As a rule, exercising the rights is free of charge. A reasonable fee may be charged, or the request refused, only when it is manifestly unfounded or excessive, and the controller must demonstrate this (Article 12(5)).
- The controller may ask for additional information to confirm the identity of the person making the request.
What to do when you receive a request
- Recognise the request, even if it comes by email, letter, telephone or orally. It is not necessary to cite the GDPR.
- Pass it on immediately to whoever handles it in the company, such as the DPO, management or the person named in the instructions. The deadline runs from receipt, and not from the moment someone opens it.
- Do not reply alone with data, without instructions. Before giving any information, identity must be confirmed.
- Do not erase or change data to "solve the problem" before the company decides. Erasing in a hurry may be unlawful.
Deceased persons
The data of deceased persons remains protected in certain cases, such as health data. The rights are exercised by whoever the person designated for that purpose or, failing that, by their heirs (Article 17 of Lei n.º 58/2019).
Complaints and compensation
Anyone who considers that their rights have been infringed may lodge a complaint with the CNPD (Article 77 of the GDPR), go to the courts and claim compensation for the damage suffered (Article 82 of the GDPR and Article 33 of Lei n.º 58/2019). Companies should have an internal procedure for handling these requests.
Summary: recognise, pass on quickly, confirm identity and do not improvise.