What rights users have under the GDPR?

 What rights users have under the GDPR?

Today we will talk about an important topic in digital marketing, the General Data Protection Regulation (GDPR). It is the strongest privacy and security law regarding the collection, the use and the storage of personal data from individuals who live in the European Union. Let’s see what rights the set up of GDPR provides to all users.

Transparency and information

First of all, users should be informed about the way their personal information is collected and the use of it. On a website, it could be a simple message mainly regarding the use of cookies, from what the user has to accept and give his consent. In addition to that, the user must be able to click on a link that redirects to the company’s private policy. He also has the right to manage the settings and choose what type of information he wants to give. 

Users must be aware that they have the right to ask the nature and the goals of the data that the website will process. When your data is collected, they have to know those elements:

• The identity and contact details of the website’ publisher

• Legal basis regarding the process of collection and the purposes

• The country where your data is collected and will be used

• The role and the interests of any third parties

• Any recipients of personal data

• If the company have the intention to transfer your data for instance to another country

• The length of time your data will be kept and stored

• Be aware of your rights to rectify and erase your information

• Be aware of your right to withdraw your consent

• Be aware of the relevant authority in order to complain

• If the collection of your data is a contractual requirement

• Be aware of any profiling techniques and any types of marketing practices

Access

Secondly, any user has the right to access their data. GDPR is all about transparency, therefore as a user, you have the right to ask for a copy of all the data a website may have on you. In order to be able to ask for it, the company needs to make available to users a form for Data Requests. Then, the website needs to explain all the steps you have to follow to collect your data copy.

Rectification and/or deletion

Users have the right to change, rectify or erase the personal information they provide to a company when they believe that their data are no longer relevant or accurate. If a company keeps incorrect data, the privacy of users will be threatened and therefore not quite respected. It could be a problem if you want to call a user but he changed his number and now another person has this number but he didn’t agree to be contacted by your company. Thus, every two years, companies have been recommended to ask again about their database in order to know if their users still consent or if some of them want to be deleted. 

Objection and avoidance to automated individual decision-making

Users have the right to object to companies’ data processes especially when it is related to direct marketing practices. Here is a concrete example. A consumer should complain when he unsubscribes several times to your newsletter but the company continues to send him those emails.

Besides, if companies need to use automated decision-making, they have to describe those practices simply and understandably, and inform their users.

Restrictions

Users have the right to request a restriction regarding the process of using data under certain conditions:

• User contests the data’ accuracy

• User objects to an illegal process and wants the company to limit the process rather than erasing all the data

• The company does not need to process that data but they need to keep it regarding the establishment, exercise or defence of a legal claim.

Following this type of request, companies must stop processing users’ data as long as they requested it while respecting the conditions quoted below.

There are, actually, a lot of rights for users under the General Data Protection Regulation. However, it is important to inform both companies and users of their respective obligations and rights. On one hand, a lot of companies do not yet respect users’ privacy. And on the other hand, some users and consumers don’t know that they have the right to be informed, the right to access their personal information, the right to change or erase their data, the right to restrict the process and the right to object and avoid automated profiling and decision-making.

#GDPR #privacy #data #protection #laws

Emma Griffon

General Data Protection Regulation (GDPR). n.d. General Data Protection Regulation (GDPR) – Official Legal Text. [online] Available at: <https://gdpr-info.eu/> [Accessed 11 April 2021].

i-SCOOP. n.d. Data subject rights under GDPR - the fundamental and contextual rights. [online] Available at: <https://www.i-scoop.eu/gdpr/data-subject-rights-gdpr/> [Accessed 11 April 2021].

Nicole O., 2021. The Eight User Rights Under the GDPR - Privacy Policies. [online] Privacy Policies. Available at: <https://www.privacypolicies.com/blog/gdpr-eight-user-rights/> [Accessed 11 April 2021].