GDPR Basics Part 4: Rights Of Data Subjects

One of the EU's key objectives in adopting the General Data Protection Regulation ("GDPR") is to contribute to the well-being of individuals by reinforcing their rights with respect to their own personal data.

As from 25 May 2018, persons and companies acting as data controllers should comply with the reinforced data subjects' rights under the GDPR. Further, they should also implement adequate systems and processes to "facilitate the exercise"of such individual rights. Infringements of the data subjects' rights will be subject to significant fines.

You will find below a brief review of some of the most important rights of data subjects that every data controller must consider before the entry into effect of the GDPR.

Right to be informed and to access to information The GDPR requires that controllers process personal data in a transparent manner. This means that every controller should provide to the data subjects certain information regarding the collection and processing of their personal data (e.g. the identity and the contact details of the controller and, where applicable, of the controller's representative and/or the data protection officer, the purposes of the processing as well as the legal basis for the processing, the recipients or the categories of recipients of the personal data etc.). The GDPR expands the scope of information to be provided to data subjects by adding the requirement to inform the data subject about:

the existence of his or her rights to erasure, to rectification, to restriction of processing, to object to processing and to file a complaint with the competent national Data Protection Authority; the source of the information where such information was not collected from the data subject; the period for which the data would be stored, or if that is not possible, the criteria used to determine that period. The GDPR distinguishes between personal data collected from the data subject, in which case the abovementioned information should be provided at the time when such personal data is obtained, and personal data obtained from other sources, in which case the controller shall be under the obligation to provide the information "within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed". In any case, if the personal data shall be used for the purpose of communicating with the data subject or if...