GDPR Articles With Commentary & EU Case Laws by Adv. Prashant Mali (red seas under red skies txt) 📕

data subject will first request access in order to verify if the data has been indeed misspelled. If it has been, rectification should be made as soon as possible. Another scenario where rectification will be needed is the case when some information is changed – for example the home address. The time frame to address a rectification is one month. In case of complex and/or high volume requests the controller can seek an extension for up to two additional months.

Article 12 (b) of the Directive granted the data subjects the right to obtain, as appropriate, rectification, erasure or blocking of data, the processing of which does not comply with the Directive, in particular because of incomplete or inaccurate nature of the data. The right to rectification is intended to complement the right of access, giving to the data subject the power to prevent the processing activities from resulting in the distribution or use of false information.

Art. 17 GDPR Right to erasure (‘right to be forgotten’)

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall

have the obligation to erase personal data without undue delay where one of the following grounds applies:

The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

The data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

The data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

The personal data have been unlawfully processed;

The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

The personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

For exercising the right of freedom of expression and information;

For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

For reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

For the establishment, exercise or defence of legal claims.

Suitable Recitals

(65) Right of rectification and erasure; (66) Right to be forgotten.

COMMENTARY:

Data subjects are entitled to require a controller to delete their personal data if the continued processing of those data is not justified. Data subjects have the right to erasure of personal data (the "right to be forgotten") if:

The data are no longer needed for their original purpose (and no new lawful purpose exists);

The lawful basis for the processing is the data subject's consent, the data subject withdraws that consent, and no other lawful ground exists;

The data subject exercises the right to object, and the controller has no overriding grounds for continuing the processing;

The data have been processed unlawfully; or

Erasure is necessary for compliance with EU law or the national law of the relevant Member State.

Presented with great fanfare as the major innovation of the Regulation, the right to erasure, however, was already contained, at least in embryo in the Directive, in its Article 12, paragraph (b). We refer here to the important judgment delivered by the Grand Chamber of the Court of Justice of the European Union of 13 May 2014 ((CJEU, Google Spain SL c. Costeja, 13 May 2014, C-121/12). After considering that Google is subject to the provisions of Directive 95/46/EC (or the transposition law) and considered to be a data controller, the Court found that the right to rectification and to object enshrined in those provisions permit a person to remove links to data.

The requests under Articles 12 (b) (rectification) and 14, first paragraph, (a) (object) of the Directive could be made directly by the data subject to the controller who must duly consider the grounds thereof and, if necessary, terminate the processing of the data in question. When the controller fails to respond to these requests, the data subject can notify supervisory authority or judicial authority to carry out the necessary checks and order the controller to perform specific actions accordingly.

Art. 18 GDPR Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

The data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.

Suitable Recitals

(67) Restriction of processing.

COMMENTARY:

In some circumstances, data subjects may not be entitled to require the controller to erase their personal data, but may be entitled to limit the purposes for which the controller can process those data (e.g., the exercise or defense of legal claims; protecting the rights of another person or entity; purposes that serve a substantial public interest; or such other purposes as the data subject may consent to). Data subjects have the right to restrict the processing of personal data (meaning that the data may only be held by the controller, and may only be used for limited purposes) if:

The accuracy of the data is contested (and only for as long as it takes to verify that accuracy);

The processing is unlawful and the data subject requests restriction (as opposed to exercising the right to erasure);

The controller no longer needs the data for their original purpose, but the data are still required by the controller to establish, exercise or defend legal rights; or

If verification of overriding grounds is pending, in the context of an erasure request.

Article 12 (b) of the Directive already required the Member States to ensure to the data subject the right to obtain blocking of data, the processing of which does not comply with the Directive, in particular because of incomplete or inaccurate nature of the data. The notion of “blocking of data” has not, however, been subject to any definition in the Directive.

Art. 19 GDPR Notification obligation regarding rectification or erasure of personal data or restriction of processing

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1)

and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

Suitable Recitals

(66) Right to be forgotten.

COMMENTARY:

It is only possible to give full effect to the rights of data subjects if all parties who are processing the relevant data are aware that the data subject has exercised those rights. Therefore, controllers must notify any third parties with whom they have shared the relevant data that the data subject has exercised those rights.

Where a controller has disclosed personal data to any third parties, and the data subject has subsequently exercised any of the rights of rectification, erasure or blocking, the controller must notify those third parties of the data subject's exercising of those rights. The controller is exempt from this obligation if it is impossible or would require disproportionate effort. The data subject is also entitled to request information about the identities of those third parties. Where the controller has made the data public, and the data subject exercises these rights, the controller must take reasonable steps (taking costs into account) to inform third parties that the data subject has exercised those rights.

The Directive already required the states to guarantee to data subjects the right to obtain notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking, unless this proves impossible or involves a disproportionate effort (see Article 12 c)).

Art. 20 GDPR Right to data portability

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

The processing is based on consent pursuant to point (a) of Article 6(1) or point

(a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and

The processing is carried out by automated means.

In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the

performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

Suitable Recitals

Right of data portability.

COMMENTARY:

This right applies if the processing is carried out by automated means and Data Subject provided personal data on the basis of his or her consent, or the processing is necessary for the performance of a contract. Under those conditions, if the Data Subject requests it: (i) provide with the data received by the DS in a structured, commonly used and machine-readable format and, (ii) allow the transmission of the data to another DC.

This new right is one of the major innovations of the Regulation and in general, probably expresses a very important development in the progress to recovery of control on the data by the data subject itself. If the goal is laudable, it remains to see how it will be implemented in practice, insofar as it implies a dialogue of the controllers and doubtlessly, an agreement - at least implicit - on the means and the standards used for data recovery. The text says nothing about the further use of the data by the first controller with which this right is exercised. It is concluded that the general principles of protection continue to apply and that the controller can keep it only to the extent strictly necessary for the announced purposes. The text says nothing either about the fate of the data "generated" by the use of a product or service and which are not actually 'communicated' by the data subject: data related to billing, traffic data, location data, etc. Are they covered by this new right?

Section 4: Right to object and automated individual decision making Art. 21 GDPR Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

In the context