Data subjects' rights in the General Data Protection Regulation

The processing of personal data. can affect people in many ways. Their rights, the "data subjects' rights", are a core component of the General Data Protection Regulation (GDPR). It devotes an entire chapter to them. In order to be able to exercise these rights, one needs to know what data are stored and processed about one's person and by whom. Therefore, the articles 13 and the 14 GDPR lays down extensive transparency obligations for data processing bodies. This information must provide an overview of data processing in an understandable form. In most cases they are included in the data protection declaration. In addition Article 15 GDPR a right of access, according to which each body must provide information on request on what data relating to a person are being processed.

Data subjects can contact companies, public authorities and other data processing bodies directly. Should problems arise, they have the opportunity to supervisory authority to switch on. In particular, the following rights of data subjects are at stake.

Overview of statutory data subject rights in the GDPR

Right to withdraw consent (Article 7 GDPR)

Data subjects have the right to withdraw their consent to the processing of their data. They must be informed before giving their consent. Revocation must be as simple as giving consent. If the data are collected from the data subject, after Article 13 II c GDPR at the time of data collection, the data controller must inform the data subject, in addition to many other information obligations, about the right to withdraw consent.

Right of rectification (Article 16 GDPR)

If incorrect data relating to a person are processed, their correction may be requested. Incomplete data must be completed taking into account the purpose of the processing.

Right of cancellation (Article 17 GDPR)

If there are certain reasons for deletion, the data subject has the right to have the personal data deleted. This is particularly the case if they are no longer necessary for the purpose for which they were originally collected or processed. If they have been made public, the data subject has a "right to be forgotten". This explicit right is new.

Right to restrict processing (Article 18 GDPR)

The right to limit processing may, under certain conditions, enable data subjects to obtain the blocking of their personal data from the controller. The controller must notify data subjects of the rectification, erasure and restriction of processing.

Right to data transferability (Article 20 GDPR)

Data subjects have the right to transfer their own data from one responsible person to another responsible person (e.g. from one social network to another). For this purpose, the operator of the e.g. network must provide the user with a copy of the personal data concerned in a common and machine-readable file format. Compared to the old legal situation under the Federal Data Protection Act, this requirement represents an innovation.

Right of objection (Article 21 GDPR)

Data subjects also have the right to object to legitimate data processing operations carried out in the public interest, in the exercise of official authority or on the basis of the legitimate interest of a body. Data subjects may object to direct marketing and related profiling at any time. This leads to an immediate stop of processing. The data subject must be informed of this right in an understandable form at the latest at the time of the first communication.

Automated decision in individual cases including profiling (Article 22 GDPR)

Data subjects may not be subject to a purely automated decision - including profiling - if it is legally relevant or significantly prejudicial. Data subjects must have the possibility to challenge the decision, to present their point of view and to obtain the intervention of a person.