Transparency and individuals’ rights

Transparency

Articles 13 and 14 list what people must be told: who the controller is, the DPO’s contact details, purposes and lawful bases, recipients, international transfers, retention periods, their rights, the right to complain to a supervisory authority, and whether automated decision-making takes place. Information must be concise, transparent, intelligible and easily accessible, in clear and plain language (Article 12). Where data is obtained from someone else, it must be provided within a reasonable period and at the latest within one month.

The rights

• Access (Article 15): a copy of the data and supporting information, normally free of charge.
• Rectification (Article 16) of inaccurate data.
• Erasure (Article 17) in defined circumstances, for example where data is no longer necessary or consent is withdrawn.
• Restriction (Article 18) while accuracy or an objection is resolved.
• Portability (Article 20) where processing is based on consent or contract and carried out by automated means.
• Objection (Article 21), which is absolute for direct marketing.
• Not to be subject to decisions based solely on automated processing with legal or similarly significant effects (Article 22), except in defined cases with safeguards, including the right to obtain human intervention.

Handling requests

Respond without undue delay and within one month of receipt. This can be extended by two further months where necessary, taking into account the complexity and number of requests, provided the person is told within the first month. Verify identity proportionately and do not ask for more data than you need. Manifestly unfounded or excessive requests may be refused or charged for, but the controller must be able to show why. Keep a log of every request and response.