Knowledge is power: Your right of access
The right of access in practice: Figuring out who knows what about you
The anticipation is building up: The date for the big concert you’re attending with your friends is just around the corner! You had bought the tickets online and also signed up for the shop’s newsletter. In the days and weeks after the concert you notice an increase in e-mail ads for events and products. “Who are these companies and how to they know my e-mail address?”, you ask yourself, since you really don’t want to receive all these ads.
This is where the right of access kicks in: After finding out what companies used your data for what purpose and if they were passed along to others, you can potentially object the data processing or have your data deleted.
Requirements for companies: Information about the processing of your data needs to be in clear language
Companies processing your data are required to inform you about this processing beforehand, for free and using clear and plain language. Among other things, they need to explain what categories of data are used for what purpose, who will receive your data and for how long it will be stored. Furthermore, a provider needs to clarify if your data is used in automated decision-making, for example when profiling or scoring is being employed.
Your right of access: The basis for using many of your other privacy rights
You can ask companies and organisations — be it your mail provider or your insurance provider —if they process any of your personal data and if so, you can request information on that: What data is used and for what purpose? With whom is this data shared, for what period of time is it stored and where does it even come from in the first place? All of this information needs to be given to you at no charge and within a month after the companies receive your request to access your data. Only if you require more than one copy of data, companies can charge you for that.
Enhancing transparency: This is why information on the processing of your data is so crucial
The information requirements for companies and the right of access are in place so you can gain a clearer understanding who has what data on you for what reason. This way, you can first figure out what even happens to all your data. Then you check if the data are correct and ask yourself if you’re fine with your personal data being used in these specific ways. The right of access therefore provides you with the intelligence you need to make use of your rights to correct and delete data. In short: The informational advantage that companies used to have on you becomes smaller.
An informal letter suffices: Exercising your right of access is easy
You don’t have to ask governmental authorities to get access to your data. The first point of contact is always the data provider itself: You can ask any company, if your personal data is used and if it is, what data is processed. The best way to go about this by writing the company’s data protection officer or, if there is none, some other person or department responsible for privacy issues in the company. Some providers also offer online forms to enforce your right of access. After receiving your request, companies need to respond within one month.
The dictionary contains more details and has sources regarding transparent information and your right of access.
