Apart from the right to consent to the processing, to refuse to consent or to withdraw consent, data subjects have other unwaivable rights related to their data which must be taken into account by controllers and processors. These rights include the ones described below.
Right to information
Correlatively with the principle of transparency, data subjects have the right to be provided with certain information about the processing, such as:
● the identity of the controller;
● the categories of data concerned by the processing;
● the purpose of processing;
● the duration of storage;
● the envisaged transfers and the rights of access and rectification (see below).
This information must be provided to the data subject regardless of whether the data were obtained from him/her or not. According to the principle of transparency, the information should be in a "concise, transparent, intelligible and easily accessible form, using clear and plain language".
Right of access
Apart from the information mentioned above, the data subject has the right to obtain from the controller confirmation as to whether personal data concerning him/her are being processed, and if it’s the case, the right to obtain a copy of the data.
Right to rectification
The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her (e.g. when the person’s name, job or address have changed).
Right to erasure (right to be forgotten)
The data subject has the right to obtain (without undue delay) from the controller erasure of personal data concerning him/her, for instance, if:
● the data are no longer necessary in relation to the purposes for which they were collected;
● the data subject withdraws his/her consent, and there is no other lawful ground for processing (see above about the principle of lawfulness);
● the data have been unlawfully processed (e.g. in violation of the principle of minimisation or integrity and confidentiality).
Right to restriction of processing
The right of restriction is similar to the right of erasure; in certain cases (when the processing is unlawful or when the controller needs more time to verify the accuracy of data or seek for an alternative ground for processing), the data subject may choose to request restriction of processing instead of rectification or erasure. The restricted data become "blocked for use": they can still be stored by the controller, but can only be processed with the data subject’s consent.
Right to object
In certain specific circumstances, when processing is based on a different ground for lawfulness than consent, the data subject has the right to object to the processing of personal data concerning him/her "on grounds relating to his or her particular situation". Unlike the right to erasure, this right can be exercised even if the processing is lawful. If the data subject decides to exercise his/her right to object and the controller wants to continue to process the data, it shall be for the controller to demonstrate his/her "compelling legitimate interests" which override the interests, rights and freedoms of the data subject.