Rights of data subjects

Question 1

Right to information prior to processing

Answer 1

1. If data is collected from data subject:
   - At time of collection
   - Identity, contact details of controller
   - Purpose
   - Legal basis
   - Recipients
   - Information on transfer to another country
2. If data is collected from another source:
   - Within a reasonable time (1 month)
   - Same as (1) unless data subject already has the info, impossibility to inform or disproportionate effort, contrary to MS or EU law or professional secrecy

Question 2

Right to acess

Answer 2

1. When processing
2. Info on:
   - Purpose
   - Categories of personal data
   - Recipients
   - Storage period
   - Rights
   - Automated decision-making
   - Possibility to complain
   - Safeguards in case of transfer to 3rd country
3. In practice:
   - Can be done electronically
   - Fee can be charged

Question 3

Right to rectification

Answer 3

When data is incomplete or incorrect

Question 4

Right to object

Answer 4

1. Processing for the purpose of marketing:
   - At any time
   - No more processing
2. Other kinds of processing including profiling:
   - On grounds relating to particular situation
   - No more processing unless controller presents compelling grounds

Question 5

Right to erasure - Grounds

Answer 5

1. No longer necessary for the purposes
2. Withdrawal of consent
3. Objection to processing under art. 21
4. Unlawful processing
5. Compliance with EU or MS law
6. Consent was granted by child

Question 6

Right to erasure - Exceptions

Answer 6

1. Exercising freedom of expression and information
2. National or EU requirement
3. Public interest in the area of public health
4. In relation to the establishment, exercise or defence of legal claims

Question 7

Right to erasure - Consequences

Answer 7

1. Data will be erased in a way that makes it difficult to restore it without excessive effort
2. Recipients must be notified
3. The personal data must be public and the controller must take reasonable steps taking into account the available technology

Question 8

Right to restriction of processing

Answer 8

1. Grounds:
   - Contested accuracy of data
   - Unlawful processing
   - Establishment, exercise or defence of legal claims
   - Objection under art. 21
2. Consequences:
   - No more processing but the data still exists and is marked as restricted
3. Exceptions:
   - Consent
   - Legal claims
   - Protection of another individual
   - Public interest

Question 9

Right to data portability

Answer 9

1. When?
   - Processing on the basis of consent
   - Processing of the basis of contract
   - Processing done by automated means
2. What? Right to receive and to transmit personal data

Question 10

Rights related to automated decision-making

Answer 10

See ADM

Question 11

Rynes

Answer 11

1. House camera case

2. Household exception does not apply because the camera also recorded public space

Question 12

Google Spain

Answer 12

1. Territorial scope? Yes! Because activity was directed towards DS’s of MSs
2. Right to erasure? Yes! Because search engines are controller - Balance between DS’s rights and public interest
3. Right to be forgotten - Same, balance of interests

Question 13

Manni

Answer 13

1. Wanted to sell his real estate but struggled because Google search showed he had been bankrupt
2. Right to be forgotten? Necessary for legal certainty – No erasure

Question 14

Digital Rights Ireland

Answer 14

1. Request to examine Data Retention Directive
2. Legitimate aim? Yes - Fight against serious crime
3. Proportional? No because not strictly necessary.

Question 15

Tele2 Sverige and Watson et al

Answer 15

MS can adopt preventive measures to fight serious crime if:

1. Limited to strictly necessary
2. Access is supervised by independent authority and
3. Data is retained in the EU