Self-determined and free: Correct and delete data, unsubscribe from advertising
The right to erasure in practice: Get me out of this bonus program!
Collecting points to shop for cheap? Sign me up! The decision to take part in the bonus program a store chain offers was an easy one for you at the time. But since, you’ve stopped shopping there, you’ve cancelled your membership in the bonus program, but you continue to be contacted by the store. Now you finally want to make sure that your contact details in the program are deleted.
The General Data Protection Regulation makes this possible: You have the right to request the erasure of your data, if they’re no longer needed for a specific purpose.
Personal data about you is outdated or wrong? Ask companies to correct them!
Sometimes, personal data stored about you is wrong or incomplete. With the General Data Protection Regulation, you have the opportunity to demand from data controllers that they correct such data. You can also complete data sets about you or add an explanatory note to them. This is important, because there can be disadvantages for you if your personal data is wrong or incomplete: It might be a wrong address that leads to you not receiving your online orders, but in the case of fragmentary or faulty financial data, it could also cause issues with your cellphone contract or even a loan.
Cases when you can demand deletion of your data: Your right to be forgotten
In certain instances you can have your personal data deleted by a company. For example, you can demand erasure of your data, if it is being processed unlawfully or if the data is no longer necessary for the purpose it was originally gathered for. In case the data processing was based on your consent and you have since withdrawn that consent, you can also delete your data. Once data-processing companies have made your data public, they need to inform other data controllers about your demand to erase your data and, if necessary, any links or copies of the data — that’s your right to be forgotten.
Two things are crucial to note:
- For one, the right to erasure doesn’t mean that all your posts, financial data or search engines hits can be deleted upon your request without further ado. If personal data is being processed to exercise the right of freedom of expression and information or if this data processing is done for reasons of public interest, there needs to be a balance between these justifications and your privacy rights. Some data may never be deleted at all during a specific time frame, such as tax-related data.
- Secondly, you need to be aware of another limitation: The right to be forgotten is hard to enforce, especially on the internet. For the moment, there is no clear cut technological solution guaranteeing that your personal data will vanish from the web for good. That’s why it continues to be useful to be as mindful as possible about which of your personal data you share online in the first place. The General Data Protection Regulation now offers additional tools to legally enforce a deletion later.
No ads, please: Your right to object data processing for marketing
The right to object supports you in all those cases in which your data is processed without needing your consent. The General Data Protection Regulation does allow such data processing in certain instances, but at the same time, it gives you the right to object. That way, you can defend yourself against potentially unfair or unwanted data processing. Companies using your data must inform you about your right to object and they need to justify why their own legitimate interests for processing your personal data override your privacy rights.
What’s important to note: You can object the processing of your data for direct marketing purposes at all times — no questions asked. Such direct marketing purposes include personalized letters, calls or e-mails immediately addressing you. In this case, there doesn’t need to be any balancing or weighing of interests with companies’ legitimate interests. An e-mail to the company or a note in the comment section next time you order something online is enough to stop annoying ads.
Restricting data processing: The workaround when you’re waiting on a correction of your data
Contrary to having your personal data erased, the restriction of data processing is usually temporary. Your personal data are still stored at a certain company, but they’re not being used. This can happen, for instance, while the company is evaluating whether your demand to have your data corrected or your objection to the data processing is valid.
Please pass along: Companies need to inform others of your demands
Once your personal data has been corrected or deleted, the data-processing company is required to inform all other recipients of the data that a correction has been done. There’s one limitation to this: If the technical effort is too high, this notification requirement might be waived for companies.
Easy enforcement: A note to the companies suffices
You can exercise your rights to erasure, to rectification and to object directly with the companies themselves: You can demand any organisation processing your personal data to correct wrong data or delete unused data. You can also object the use of your data for direct marketing purposes. The best way to go about this is to make your demands in written form, for example contacting the data protection officer or, if a company doesn’t have one, another person or department in the company responsible for privacy issues.
The dictionary contains more details and has sources regarding your rights to object, to rectification, to erasure and to restriction of processing as well as on companies’ notification obligation.
