General Data Protection Regulation Individuals’ rights
The rights that individuals had over their data in the 1998 Act are carried over to the GDPR, but in some cases these are strengthened and have been added to as set out in the table below.
Former Data Protection Act 1998 rights
The new General Data Protection Regulation rights
The right to be informed
The 1998 Act provided the right to ‘fair processing information’, typically given through a privacy notice. The information had to include:
·the identity of the data controller,
·if the controller has nominated a representative, the identity of that representative,
·the purpose or purposes for which the data are intended to be processed, and
·any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair.
The GDPR sets out the information that should be supplied and when individuals should be informed. The GDPR specifies additional information than that under the 1998 Act that should be supplied at Articles 13 and 14.
The right of access
The 1998 Act provided that an individual who makes a written request and pays a fee is entitled to be: told within 40 days whether any personal data is being processed; given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people; given a copy of the information comprising the data; and given details of the source of the data.
The GDPR provides a similar right but the information must be provided for free although a ‘reasonable fee’ may be applied when a request is manifestly unfounded or excessive, particularly if it is repetitive. The time limit to respond is one month, or three months in complex cases.
The right to rectification
Where the personal data held about them was inaccurate, the individual concerned had a right to apply to the court for an order to rectify, block, erase or destroy the inaccurate information.
Individuals are entitled to have personal data rectified if it is inaccurate or incomplete. It must be done within one month, or three months in complex cases. Where no action is taken individuals have the right to be informed of how to seek a judicial remedy.
The right to erasure
The 1998 Act did not provide the right to erasure, but an individual could apply to a court for an order for erasure of inaccurate personal data.
Individuals have a right to have personal data erased in specific circumstances:
·where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed;
·when the individual withdraws consent;
·when the individual objects to the processing and there is no overriding legitimate interest for continuing the processing;
·when the personal data was unlawfully processed;
·when the personal data has to be erased in order to comply with a legal obligation; or
·when the personal data is processed in relation to the offer of information society services to a child.
The right to restrict processing
The 1998 Act allowed individuals to apply to a court for an order to block or suppress processing of personal data where it is inaccurate. When processing was restricted, it was permissible to store the personal data, but not further process it.
Where it is claimed that data is inaccurate individuals can require the controller to restrict processing until verification checks have been completed. Individuals may also require controllers to restrict processing where the controller no longer needs to (other than for legal claims).
The right to data portability
Not applicable
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services where processing is based on consent or performance of a contract.
It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.
The personal data must be provided in a structured, commonly used and machine readable form. The information must be provided free of charge.
The right to object
The 1998 Act provided individuals with the right to object to the processing of personal data for direct marketing.
In addition to being able to object to direct marketing, individuals have the right to object to processing (including profiling) based on legitimate interests or the performance of a task in the public interest/exercise of official authority, and processing for purposes of scientific/historical research and statistics.
Rights in relation to automated decision making and profiling
The 1998 Act allowed an individual access to information about the reasoning behind any decisions taken by automated means. An individual could give written notice requiring that automated decisions are not made using their personal data. Individuals could ask for a decision taken by automated means to be reconsidered.
The GDPR provides similar rights and additionally defines profiling as any form of automated processing intended to evaluate certain personal aspects of an individual.