The General Data Protection Regulation (GDPR) is a key piece of legislation in the European Union that governs the processing of personal data. Its aim is to ensure that data processing is lawful, transparent, and secure, while also protecting individuals’ rights. The regulation also defines oversight practices that ensure organisations comply with the rules and respect user rights.
What are the key principles of the General Data Protection Regulation?
The key principles of the General Data Protection Regulation guide the processing of personal data in the European Union. They ensure that data processing occurs lawfully, transparently, and securely, while taking into account individuals’ rights.
Lawfulness of personal data processing
Personal data processing is lawful when it is based on a clear legal basis. Such bases include consent, contractual obligations, or legal obligations. It is important that the data controller can demonstrate that the processing is justified.
- Consent: The individual must provide informed consent for the processing of their data.
- Contract: Processing may be necessary for the performance of a contract.
- Legal obligation: Processing may be necessary for compliance with the law.
Obligations of the data controller
The data controller has several obligations related to the processing of personal data. These include protecting data and respecting individuals’ rights. The data controller must also maintain a record of processing activities.
- Ensure the security and confidentiality of data.
- Provide information about the purpose and basis of processing.
- Respond to individuals’ requests in a timely manner.
Right to erasure
Individuals have the right to request the deletion of their data under certain circumstances, such as when the data is no longer necessary for the purposes of processing. This right is also known as the “right to be forgotten.”
- A deletion request can be made if the data is inaccurate or the processing is unlawful.
- However, this right is not absolute; in certain situations, data may still be retained.
Right to data portability
The right to data portability means that individuals can request their personal data to be transferred to another data controller. This right applies to data provided with consent or for the performance of a contract.
- The individual must be able to receive the data in a machine-readable format.
- Portability can enhance the user’s freedom of choice and control over their data.
Right to be forgotten
The right to be forgotten means that individuals can request the deletion of their data if it is no longer necessary or if consent is withdrawn. This right is particularly important in the digital environment.
- The individual must inform the data controller that they wish for their data to be deleted.
- The data controller must assess the request and implement it unless there are lawful grounds to refuse.
Right to object to processing
Individuals have the right to object to the processing of their personal data in certain situations, such as in the context of direct marketing. This right allows individuals to have better control over their own data.
- The objection may be based on the individual’s specific circumstances.
- The data controller must demonstrate that there are compelling legitimate grounds for the processing.
Right to access personal data
Individuals have the right to check what data has been collected about them and how it is processed. This right helps ensure the accuracy and transparency of data.
- An access request can be made to the data controller, who is obliged to respond to the request in a timely manner.
- The individual can receive information about the purpose and legal basis of processing.
Right to rectification
Individuals have the right to request the rectification of inaccurate or incomplete data. This right ensures that personal data remains up to date and accurate.
- The rectification request must be submitted to the data controller, who will assess its validity.
- The data controller must carry out the rectification without undue delay.
Right to restrict processing
Individuals have the right to restrict the processing of their personal data in certain situations, such as when the accuracy of the data is contested. This right allows for the prevention of data use until the matter is resolved.
- Restriction may be necessary when the processing is unlawful or the data is no longer needed.
- The individual must inform the data controller of their request for restriction.
Right to data protection
The right to data protection means that individuals have the right to have their data adequately protected. The data controller must implement necessary technical and organisational measures to safeguard the data.
- Data protection may include encryption, access control, and other security measures.
- Individuals have the right to demand protection of their data if it is at risk.
Right to lodge a complaint with a supervisory authority
Individuals have the right to lodge a complaint with a supervisory authority if they believe their data protection rights have been violated. This right is an important part of data protection oversight and ensures that data controllers comply with the rules.
- A complaint can be made to the national data protection authority, which will investigate the matter.
- Individuals do not have to pay to make a complaint.
Right not to be subject to automated decision-making
Individuals have the right not to be subject to automated decision-making that may affect their rights or obligations. This right protects individuals from potentially harmful decisions.
- Automated decision-making can only occur if it is based on law or the individual’s consent.
- Individuals have the right to request a human assessment instead of automated decisions.
Right to information about data processing
Individuals have the right to receive clear and understandable information about how their personal data is processed. This right promotes transparency and trust in data controllers.
- Information must be provided about the purpose of processing, legal basis, and retention period.
- The data controller must ensure that the information is easily accessible and comprehensible.
Right to data processing appropriateness
The right to data processing appropriateness means that personal data can only be processed if it is necessary and appropriate. This principle prevents unnecessary data collection.
- Data processing must be linked to clear and lawful purposes.
- The data controller must assess whether the processing is necessary and reasonable.
Right to transparency in data processing
The right to transparency in data processing ensures that individuals receive sufficient information about how their data is processed. This right fosters trust and accountability among data controllers.
- The data controller must provide clear and understandable information about processing practices.
- Transparency in data processing helps individuals understand their own rights.
Right to restrict data processing
The right to restrict data processing allows individuals to prevent their data from being processed in certain situations. This may be necessary when the accuracy of the data is contested or the processing is unlawful.
- Restriction can be implemented until the matter is resolved or when the data is no longer needed.
- The individual must inform the data controller of their request for restriction.
Right to security of data processing
The right to security of data processing means that the data controller must implement appropriate measures to protect the data. This protects individuals’ data from harm or unauthorised use.
- Security measures may include encryption, access control, and regular security audits.
- The data controller must continually assess and update their security measures.
Right to predictability in data processing
The right to predictability in data processing means that individuals have the right to know in advance how their data will be processed. This helps them make informed decisions about their data.
- The data controller must provide clear information about processing practices and potential risks.
- Predictability increases trust in data controllers and their practices.
Right to fairness in data processing
The right to fairness in data processing ensures that personal data is processed fairly and reasonably. This principle protects individuals from potential abuses.
- Processing must be based on a legal basis that is clear and understandable.
- The data controller must ensure that processing does not cause harm to individuals.
