The GDPR

Article 12 requires the controller to provide procedures and mechanisms for the data subjects to exercise their rights. 

A principle of transparency is proclaimed: any information to the public or to the data subject should be easily accessible and easy to understand in a concise and transparent form, and formulated in clear and simple terms - in particular for any information addressed specifically to a child. It applies both to the exercise of the right to information (Art. 13 and 14) and to the right to access (Art. 15 ), the rights to rectification and erasure (Art. 16 and 17), the right to limitation of processing (Art.  18), the right to data portability (Art. 20 ), the right to object (Art. 21 ), the right not to be subject to automated individual decision-making (Art. 22), and regarding the obligation of official notification (Art. 19) And finally, that of the right to communication of a personal data breach (Art. 34).

The information may be provided in writing or by other means, if necessary, electronically, if this is appropriate. If the data subject exercises his or her right in an electronic form, the information can usually be provided electronically, unless the data subject requests it otherwise. If the data subject so requests, the information can even be provided orally, provided that the identity of the data subject is demonstrated by other means.

It is the responsibility of the controller to facilitate the exercise of the rights referred to in Articles 15 to 22 above. In case of application of Article 11, (2) concerning processing that does not require identification, the controller cannot deny the rights of the data subject, unless proven not being able to identify them.

Maximum times for response are provided. Thus, for the rights envisaged in Articles  15-22 , the information must be provided  promptly and in any event within one month of receipt of the request. This period may be extended by two months if necessary, given the complexity and the number of requests. In this case, the data subject must be specifically informed of the postponement reasons, within one month of receipt of the request. If the controller does not give any response to the request made by the data subject, he or she shall inform them of the reasons for his inaction and of the possibility to lodge a complaint with a supervisory authority, without delay and within one month of receipt of the request at the latest.

The principle of free exercise of rights is generalized to provide information under Articles 13 and 14 and to proceed with all communication and take any measure under Articles 15 to 22 and Article 34.

When any requests by a data subject are manifestly unfounded or excessive, in particular due to their repetitive character, the controller may either require the payment of a reasonable fee based on administrative costs or refuse to reply. In both cases, it is up to the controller to demonstrate clearly the unfounded or excessive nature of the request.

Without prejudice to Article 11 which provides for an exception based on the rights set in Articles 15 to 20 if the processing does not require identification when having reasonable doubts as to the identity of the person making the request referred to in Articles 15 to 21, it may request the provision of additional information necessary to confirm the identity of the data subject.

The provision states - which is new – that the information to be provided on the basis of Articles 13 and 14  could be accompanied by standardized icons to provide a good overview of the respective processing that should be easily visible and clearly legible and understandable. By delegation, the Commission could accept rules to determine the information presented by the icons as well as the procedures for their standardization.

The Directive

The Directive did not include a general provision on the general  mechanisms for the exercise of rights.

These varied from a national legislation to another, where the rest of the mechanisms  for  each right were provided for with more or less precision.

Potential issues

The implementation of Article 12 will require a thorough review - or even new right to be set – relevant internal procedures to meet the various requests of the data subjects or simply to make the disclosures required by the Regulation.

Strangely, the exercise of rights is not subject, as a rule, to the provision of proof of the applicant's identity, which opens the way to abuse. Caution nevertheless would require the controller to make sure in data subject’s identity before transmitting, if any, any information of a confidential nature.

European Union

Retour au sommaire

Article 29 Working Party

Guidelines on the right to data portability - wp242rev.01 (5 April 2017)

(Endorsed by the EDPB)

Article 20 of the GDPR creates a new right to data portability, which is closely related to the right of access but differs from it in many ways. It allows for data subjects to receive the personal data that they have provided to a controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller. The purpose of this new right is to empower the data subject and give him/her more control over the personal data concerning him or her.

Since it allows the direct transmission of personal data from one data controller to another, the right to data portability is also an important tool that will support the free flow of personal data in the EU and foster competition between controllers. It will facilitate switching between different service providers, and will therefore foster the development of new services in the context of the digital single market strategy.

This opinion provides guidance on the way to interpret and implement the right to data portability as introduced by the GDPR. It aims at discussing the right to data portability and its scope. It clarifies the conditions under which this new right applies taking into account the legal basis of the data processing (either the data subject’s consent or the necessity to perform a contract) and the fact that this right is limited to personal data provided by the data subject. The opinion also provides concrete examples and criteria to explain the circumstances in which this right applies. In this regard, WP29 considers that the right to data portability covers data provided knowingly and actively by the data subject as well as the personal data generated by his or her activity. This new right cannot be undermined and limited to the personal information directly communicated by the data subject, for example, on an online form.

As a good practice, data controllers should start developing the means that will contribute to answer data portability requests, such as download tools and Application Programming Interfaces. They should guarantee that personal data are transmitted in a structured, commonly used and machine-readable format, and they should be encouraged to ensure the interoperability of the data format provided in the exercise of a data portability request.

The opinion also helps data controllers to clearly understand their respective obligations and recommends best practices and tools that support compliance with the right to data portability. Finally, the opinion recommends that industry stakeholders and trade associations work together on a common set of interoperable standards and formats to deliver the requirements of the right to data portability. 

Link

Guidelines on transparency under Regulation 2016/679 - wp260rev.01 (11 April 2018)

(Endorsed by the EDPB)

These guidelines provide practical guidance and interpretative assistance from the Article 29 Working Party (WP29) on the new obligation of transparency concerning the processing of personal data under the General Data Protection Regulation1 (the “GDPR”). Transparency is an overarching obligation under the GDPR applying to three central areas: (1) the provision of information to data subjects related to fair processing; (2) how data controllers communicate with data subjects in relation to their rights under the GDPR; and (3) how data controllers facilitate the exercise by data subjects of their rights. Insofar as compliance with transparency is required in relation to data processing under Directive (EU) 2016/680, these guidelines also apply to the interpretation of that principle. These guidelines are, like all WP29 guidelines, intended to be generally applicable and relevant to controllers irrespective of the sectoral, industry or regulatory specifications particular to any given data controller. As such, these guidelines cannot address the nuances and many variables which may arise in the context of the transparency obligations of a specific sector, industry or regulated area. However, these guidelines are intended to enable controllers to understand, at a high level, WP29’s interpretation of what the transparency obligations entail in practice and to indicate the approach which WP29 considers controllers should take to being transparent while embedding fairness and accountability into their transparency measures.

Transparency is a long established feature of the law of the EU. It is about engendering trust in the processes which affect the citizen by enabling them to understand, and if necessary, challenge those processes. It is also an expression of the principle of fairness in relation to the processing of personal data expressed in Article 8 of the Charter of Fundamental Rights of the European Union. Under the GDPR (Article 5(1)(a)), in addition to the requirements that data must be processed lawfully and fairly, transparency is now included as a fundamental aspect of these principles. Transparency is intrinsically linked to fairness and the new principle of accountability under the GDPR. It also follows from Article 5.2 that the controller must always be able to demonstrate that personal data are processed in a transparent manner in relation to the data subject. Connected to this, the accountability principle requires transparency of processing operations in order that data controllers are able to demonstrate compliance with their obligations under the GDPR.

In accordance with Recital 171 of the GDPR, where processing is already under way prior to 25 May 2018, a data controller should ensure that it is compliant with its transparency obligations as of 25 May 2018 (along with all other obligations under the GDPR). This means that prior to 25 May 2018, data controllers should revisit all information provided to data subjects on processing of their personal data (for example in privacy statements/ notices etc.) to ensure that they adhere to the requirements in relation to transparency which are discussed in these guidelines. Where changes or additions are made to such information, controllers should make it clear to data subjects that these changes have been effected in order to comply with the GDPR. WP29 recommends that such changes or additions be actively brought to the attention of data subjects but at a minimum controllers should make this information publically available (e.g. on their website). However, if the changes or additions are material or substantive, then in line with paragraphs 29 to 32 below, such changes should be actively brought to the attention of the data subject.

Transparency, when adhered to by data controllers, empowers data subjects to hold data controllers and processors accountable and to exercise control over their personal data by, for example, providing or withdrawing informed consent and actioning their data subject rights. The concept of transparency in the GDPR is user-centric rather than legalistic and is realised by way of specific practical requirements on data controllers and processors in a number of articles. The practical (information) requirements are outlined in Articles 12 - 14 of the GDPR. However, the quality, accessibility and comprehensibility of the information is as important as the actual content of the transparency information, which must be provided to data subjects.

The transparency requirements in the GDPR apply irrespective of the legal basis for processing and throughout the life cycle of processing. This is clear from Article 12 which provides that transparency applies at the following stages of the data processing cycle:

• before or at the start of the data processing cycle, i.e. when the personal data is being collected either from the data subject or otherwise obtained;
• throughout the whole processing period, i.e. when communicating with data subjects about their rights; and
• at specific points while processing is ongoing, for example when data breaches occur or in the case of material changes to the processing.

Link

Retour au sommaire

European Union

CJEU caselaw

C‑307/22, FT v. DW, (23 October 2023)

1.      Article 12(5) and Article 15(1) and (3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that the controller is under an obligation to provide the data subject, free of charge, with a first copy of his or her personal data undergoing processing, even where the reason for that request is not related to those referred to in the first sentence of recital 63 of that regulation.

2.      Article 23(1)(i) of Regulation 2016/679

must be interpreted as meaning that a piece of national legislation adopted prior to the entry into force of that regulation is capable of falling within the scope of that provision. However, such a possibility does not permit the adoption of a piece of national legislation which, with a view to protecting the economic interests of the controller, makes the data subject bear the costs of a first copy of his or her personal data undergoing processing.

3.      The first sentence of Article 15(3) of Regulation 2016/679

must be interpreted as meaning that, in the context of a doctor-patient relationship, the right to obtain a copy of personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain a full copy of the documents included in his or her medical records and containing, inter alia, those data if the provision of such a copy is essential in order to enable the data subject to verify how accurate and exhaustive those data are, as well as to ensure they are intelligible. Regarding data relating to the health of the data subject, that right includes in any event the right to obtain a copy of the data in his or her medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided to him or her.

Judgment of the court

Opinion of the advocate general

---

C-154/21 (12 January 2023) - Österreichische Post (Informations relatives aux destinataires de données personnelles)

Article 15(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that the data subject’s right of access to the personal data concerning him or her, provided for by that provision, entails, where those data have been or will be disclosed to recipients, an obligation on the part of the controller to provide the data subject with the actual identity of those recipients, unless it is impossible to identify those recipients or the controller demonstrates that the data subject’s requests for access are manifestly unfounded or excessive within the meaning of Article 12(5) of Regulation 2016/679, in which cases the controller may indicate to the data subject only the categories of recipient in question.

Judgment of the Court 
Opinion of Advocate General 

---

Retour au sommaire Retour au sommaire