The GDPR gives every person rights over their data. They apply to customers, pupils, patients, employees and everyone else. As an employee you may receive a request, or want to use the rights yourself.
Right to information
Under Articles 13 and 14, people must be told who is processing their data, why, on what basis, how long it is kept and what rights they have. This is often done in a privacy notice or an information sheet. If the data does not come from the person themselves, the information must be given within a reasonable time, and at the latest within one month.
Right of access (data extract)
Under Article 15, the data subject has the right to know whether data about them is being processed. They also have the right to a copy of the data and to information on the purpose, recipients, storage period and where the data comes from. The first copy is free.
Other rights
- Rectification (Article 16): inaccurate data must be corrected, and incomplete data completed.
- Erasure, the "right to be forgotten" (Article 17): data must be deleted when, among other things, it is no longer needed or consent is withdrawn. The right is not absolute. Data that the law requires you to keep must not be deleted.
- Restriction (Article 18): the data may temporarily only be stored, for example while a correction is being examined.
- Data portability (Article 20): in some cases, the right to receive your data in a machine-readable format and to move it.
- Objection (Article 21): the right to object to processing based on legitimate interests or the public interest. Against direct marketing there is an absolute right to object, and the processing must then stop.
- Automated decisions (Article 22): a person has the right not to be subject to a decision based solely on automated processing that has legal effects or similarly significantly affects them.
How fast must we reply?
Under Article 12, the organisation must reply without undue delay and at the latest within one month. The time may be extended by a further two months if the request is complicated or many requests have been received, but the data subject must then be told within the first month. The reply should normally be free of charge. For manifestly unfounded or excessive requests the organisation may charge a fee or refuse.
The deadline runs from the day the organisation receives the request. It does not start only when the right person reads it.
How to handle a request
- Recognise it. A request does not have to mention the GDPR. "What information do you have about me?" or "Delete my details" is enough. It can arrive by e-mail, letter, telephone, chat or in a shop.
- Pass it on at once to the person the organisation has appointed, for example the data protection officer or a data protection function.
- Do not change or delete anything to avoid having to show it. That is not allowed.
- Do not hand out data yourself unless you have been given the task. The organisation must first check that the person asking really is the person the data is about.
- Do not refuse on your own initiative. That is the organisation's decision, and it may take an assessment of what can be disclosed.
Complaints and legal remedies
A person who believes the rules are not being followed can lodge a complaint with IMY (Article 77). They can also go to court and claim compensation (Article 82) if they have suffered damage.