What rights does GDPR give you over your personal data?
Since 25 May 2018, European law lets you ask a company for a copy of the personal data it holds about you.
The GDPR, the European Union's General Data Protection Regulation, gives people in the EU a set of rights over their personal data: to see it, to take it elsewhere, to have it erased in some cases, to object to some uses such as marketing, and to say yes or no to its use. This lesson describes what the regulation says. It is not legal advice.
The European Parliament and Council adopted it on 14 April 2016, to become effective on 25 May 2018. As a regulation rather than a , it has direct legal effect and does not need to be turned into national law first.
The right of access gives people the right to access their personal data and information about how it is being processed. A must provide, on request, an overview of the categories of data being processed and a copy of the actual data, and explain the purposes of the processing, with whom the data is shared, and how it acquired the data. Data portability adds that the data must come in a structured and commonly used standard electronic format.
Step 1: Access
See your data and how it is processed
Step 2: Portability
Get it in a standard electronic format
Step 3: Erasure
Request that it be removed on certain grounds
Step 4: Objection
Object to processing for marketing
Step 5: Consent
Say yes clearly, and withdraw at any time
The right to be forgotten had a more limited fate: a broad version was replaced by a more limited right of erasure in the version the European Parliament adopted in March 2014: people can request erasure on one of a number of grounds. Article 21 also lets a person object to processing for marketing or non-service related purposes.
Consent has rules too. It must be a specific, freely given, plainly worded and unambiguous affirmation. An online form with an opt-out box selected by default is a violation, because consent is not unambiguously affirmed. People must be allowed to withdraw consent at any time, and withdrawing must not be harder than opting in.
The law has been used. On 21 January 2019, Google was fined €50 million by the French data protection authority for insufficient control, consent and transparency over personal data used for behavioural advertising. The most serious infringements of the regulation can bring a fine of up to €20 million or 4% of a company's annual worldwide turnover, whichever is greater.
Quiz me
0/3
Recap
The GDPR gives rights to access, move, request erasure of, and object to the use of your data, and to refuse or withdraw consent, with fines of up to 4% of worldwide turnover.
💡 A trick to remember it · Think of a library card for your own data: you can ask to see it, copy it, ask for it to be removed, tell the library to stop, and say no.
Surprising fact · A lawsuit against four big platforms was filed hours after midnight on the day the GDPR started applying.
Sources (1)
No source, no claim. Every fact in this lesson (18 claims) cites at least one of these.