The right of access

Exercising the right of access allows you to know whether data concerning you is being processed and to obtain communication of it in an understandable format.

It also allows you to check the accuracy of the data and, if necessary, to have it rectified or deleted.

The organization from which you request your “right of access” must be able to send you a copy of the data it holds on you and provide you with information on:

  • the purposes for which this data is used,
  • the categories of data collected,
  • the recipients or categories of recipients who have been able to access this data,
  • the duration of data retention or the criteria that determine this duration,
  • the existence of other rights (right of rectification, erasure, limitation, opposition),
  • the possibility of contacting the CNIL,
  • any information relating to the source of the data collected if it was not collected directly from you,
  • the existence of automated decision‑making, including profiling, and the underlying logic, significance and consequences for you of such a decision,
  • the possible transfer of your data to a third country (non‑EU member) or to an international organization

To find out more :

https://www.cnil.fr/fr/le-droit-dacces-connaitre-les-donnees-quun-organisme-detient-sur-vous

Article 15 GDPR

Articles 39, 40‑1 to 43 of the Data Protection Act

The right of rectification

The right to erasure, or right to be forgotten

The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase such personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent to which the processing is based according to point (a) of Article 6(1) or point (a) of Article 9(2) and there is no other legal ground for the processing;

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed ;

(e) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

To find out more : Article 17 GDPR

The right to restriction of processing

1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of their use;

(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims ;

(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

To find out more : Article 18 GDPR

The right to object

Your personal data appears in a non‑mandatory file and you no longer wish for it to be included? The right to object allows you to oppose the use of your data by an organization for a specific purpose. You must put forward " reasons relating to your particular situation," except in the case of commercial prospecting, which you can object to without giving a reason.

To find out more :

https://www.cnil.fr/fr/le-droit-dopposition-refuser-lutilisation-de-vos-donnees

Article 21 GDPR

Articles 38, 40‑1 of the Data Protection Act

The right to portability

Data subjects have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine‑readable format, and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

  • (a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1);
  • and (b) the processing is carried out by automated means.

To find out more : Article 20 GDPR

The right to define directives after death

To find out more : Article 40‑1 of the Data Protection Act

The implementation of this right is subject to a decree which has not yet been published.

The right not to be subject to an automated decision

1. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

2. Paragraph 1 shall not apply where the decision:

(a) is necessary for entering into, or the performance of, a contract between the data subject and a controller ;

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(c) is based on the explicit consent of the data subject.

To find out more :

Article 22 GDPR

Article 10 of the Data Protection Act