Data subjects' rights
The eight rights the GDPR gives to individuals: their conditions, their limits, the one-month deadline to answer, the absence of charge and the complaint to the CNIL. Recognising the request and deciding what follows.
- 25 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the timeline
- Scenarios
A few cards from the deck
Right of access: what is it?
Show the answer
The right to obtain confirmation that one's data are processed, a copy of them and information about the processing.
The first copy is free. The answer must not reveal another person's data: whatever concerns a third party is redacted.
How much may the controller charge for the first copy of the data a person asks for?
- Nothing: the first copy is free
- A flat fee set by the CNIL
- The real cost of handling the request
- Nothing, unless the person is not a customer
Show the answer
Nothing: the first copy is free
Exercising rights is free. Reasonable fees are allowed only for additional copies, or for a request that is manifestly unfounded or excessive.
The controller answers a request within …, extendable by at most … if the request is complex or requests are numerous.
Show the answer
The controller answers a request within one month, extendable by at most two months if the request is complex or requests are numerous.
The person must be told of the extension and its reasons within the first month. A request received on 3 March calls for an answer before 3 April, or 3 June at the latest.
Right to erasure: what is it?
Show the answer
The right to have one's data deleted when, for example, they are no longer necessary or consent is withdrawn.
It is not absolute: what the law requires to be kept, such as invoices, or what is needed to defend a legal claim, stays.
A customer closes his account and asks for all his data to be erased, while the company must keep his invoices for ten years. What must it do?
- Erase everything, invoices included, since the request overrides accounting law
- Erase the profile and marketing data, keep the invoices under a legal obligation
- Keep everything for ten years, since the invoices' period covers the whole file
- Refuse the request outright, since erasure is never due after a contract
Show the answer
Erase the profile and marketing data, keep the invoices under a legal obligation
Erasure yields to a legal duty to retain, but only for what it requires. The remaining data no longer has a reason to be kept.