You may have heard of “individuals’ rights” or maybe “data subject rights”, which data controllers must facilitate (and which processors must assist the controller with facilitating) but do you know what these rights are? If not, keep reading for a quick overview of the rights individuals have under UK GDPR.
- The right to be informed
Individuals have the right to know about the collection and use of their data. Organisations are required to be transparent about what data they’re collecting, why they’re collecting it, and how they plan to use it. This information is typically provided in privacy notices when the data is collected from the individual (or shortly thereafter when it is collected from other sources). This is your opportunity to show people you care about their rights and the privacy of their information at the start your relationship with them (you can see our article about what makes a good privacy notice here).
- The right of access
The right of access means individuals can request a copy of their personal data along with information about how it’s being processed. This is probably the most well-known right, the exercise of which is commonly known as a DSAR (Data Subject Access Request).
- The right to rectification
This is the right to correct incorrect personal data and to complete personal data which is incomplete (in some circumstances). You already have obligations to ensure the data you collect and use is accurate but you must also take reasonable steps to satisfy yourself of the accuracy of data on request by the data subject.
- The right to erasure
UK GDPR gives individuals the right to have their personal data erased in some circumstances. An example could be when the data is no longer necessary for the purposes you collected/processed it for or when processing is based on consent and the individual withdraws their consent.
- The right to restrict processing
The right to restrict processing allows individuals to pause the use of personal data under certain circumstances. If this right is exercised you will be able to store the data, but not use it. This is often used as an interim measure whilst, for example, the accuracy of personal data is verified.
- The right to data portability
This right allows individuals to obtain their data in a structured, commonly used, machine readable format as well as a right to ask you to transfer the data to another controller. This might apply when consumers want to switch from one service provider to another, although in practice this right is not often used.
- The right to object
Individuals have the right to object to the processing of their personal data in certain circumstances. You will need to stop processing the data unless you can demonstrate compelling reason to do so that overrides the individual’s interests or the processing is necessary to establish, exercise or defend legal claims. The exception to this is objections to direct marketing, which must always be honoured.
- Rights in relation to automated decision-making
Individuals have the right not to be subject to decisions about them which are based solely on automated processing and have a legal or similarly significant effect on them, save under specified circumstances. Where these decisions are permitted, the UK GDPR provides for several rights in relation to this, at least, the right to specific information about the processing, the right to receive an explanation of the decision, obtain human intervention, express their view and the right to challenge and request a review of the decision.
It is important to note that the rights discussed in this article are not absolute, they are limited in scope (in ways too detailed to cover in this article) and there are also exemptions which may apply meaning that you do not have to comply with a request, so considering the scope of the right and applicable exemptions is essential in every case.
For more information on getting it right when responding to data subject rights requests, see our five practical tips here and if you would like any help in managing data subject rights requests, please contact a member of our team at hello@hellodpo.com.
