The GDPR and Your Rights: Access, Rectification, Erasure

Companies collect an astonishing amount of information about you, and until recently you had little say about it. In the European Union, a law now gives you real rights: to see your data, to correct it, to have it deleted and more. In this lesson you will learn what the GDPR is, the rights it gives you, and, most practically, how to exercise them with a simple written request.

In Chapter 4 you reduced what you publish yourself. Now we turn to the data that organizations hold about you, from shops and social networks to employers and public services. Good news: you are not powerless.

What is personal data?

Personal data is any information that relates to an identified or identifiable person. That is a broad definition. It includes the obvious (name, address, email, phone number, photos) and the less obvious: an IP address, a device identifier, location history, purchase history, a customer number, and even a combination of facts that points to you without naming you.

Some categories are sensitive and receive stronger protection: health, political opinions, religious beliefs, sexual orientation, biometric data used to identify you, and others. Processing them is generally prohibited unless specific conditions are met.

What is the GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation that applies in all member states. It came into force in 2018 and sets common rules for how personal data may be collected and used. Several non-European countries have adopted similar laws, with differences in detail.

Its reach is wide. The GDPR applies to organizations established in the EU, and also to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. So a foreign website that targets European users still has to respect it.

In each country an independent supervisory authority enforces the rules. In France, it is the CNIL (Commission nationale de l'informatique et des libertés). If you live elsewhere, search for your national data protection authority. The text of the regulation and French implementing laws are available on legifrance.gouv.fr, and the regulation is also published in the official EU journal.

The principles behind the rules

Organizations that handle your data must follow a few core principles:

• Lawfulness, fairness and transparency: there must be a legal basis (such as your consent, a contract, a legal obligation or a legitimate interest), and you must be told clearly what happens to your data.
• Purpose limitation: data collected for one purpose should not be reused for an unrelated one.
• Data minimization: only what is necessary should be collected.
• Accuracy: data should be correct and up to date.
• Storage limitation: data should not be kept forever.
• Integrity and confidentiality: data must be protected by appropriate security measures. This is where the security habits of this course meet the law.
• Accountability: the organization must be able to prove that it complies.

Your main rights

The GDPR gives you a set of rights. These are the ones you will use most:

1. Right of access: you can ask an organization whether it holds data about you, and obtain a copy together with information about why it is used, who receives it, how long it is kept and where it came from.
2. Right to rectification: you can require that inaccurate or incomplete data be corrected.
3. Right to erasure (often called the "right to be forgotten"): in certain cases, such as when the data is no longer necessary, when you withdraw your consent, or when the data was unlawfully processed, you can ask for it to be deleted. It is not absolute: an organization may keep data it is legally required to keep, for example invoices for accounting.
4. Right to restriction: in some situations, you can ask for the use of your data to be frozen while a dispute is resolved.
5. Right to data portability: you can receive the data you provided in a common, machine-readable format and have it transferred to another service where technically feasible.
6. Right to object: you can object to certain processing, in particular for direct marketing, which must stop when you object.
7. Rights regarding automated decisions: in certain cases, you have the right not to be subject to a decision based only on automated processing that significantly affects you, and to ask for a human review.
8. Right to withdraw consent at any time, as easily as you gave it.

Organizations must also tell you how to contact their data protection officer (DPO) or privacy contact when they have one, and must notify the authority, and sometimes you, when a data breach puts your rights at risk.

How to exercise your rights

Many people think this is complicated. It is not. The process is mostly writing a clear message:

1. Find the contact. Look in the privacy policy or the legal notice of the website for the privacy contact or DPO address. Many services also have a form or a settings page dedicated to downloads and deletions.
2. Write a clear request. State who you are, which right you exercise and what you ask for. Keep it short and polite. Keep a copy.
3. Prove your identity, carefully. The organization may ask for proof, to avoid giving your data to an impostor. Provide only what is necessary, and avoid sending more documents than needed. If a copy of an ID is required, you can mark it with the purpose and the date, and cover unneeded information.
4. Wait for the answer. The organization generally must reply within one month, a period that can be extended in complex cases, with an explanation.
5. Escalate if needed. If you do not get an answer, or you are dissatisfied, you can file a complaint with your national data protection authority, which in France is done through the CNIL website.

A model message

Subject: Request to delete my personal data (GDPR, Article 17)

Hello,

I am a user of your service under the email address [your address].
Pursuant to the General Data Protection Regulation, I request
the erasure of all personal data you hold about me, and ask you to
confirm in writing once this has been done.

If you cannot comply fully, please tell me which data you must retain,
for what legal reason and for how long.

Kind regards,
[Name]

To exercise the right of access, replace the request by "I request a copy of all the personal data you hold about me, together with the information provided for in Article 15". Note that this model is a general illustration and not legal advice.

Be careful of fake data requests

Scammers sometimes pose as the "data protection authority", as a company that has "found your data", or as a service offering to "delete your personal data from the internet for a fee". Do not send documents or payments to such contacts. Always go to the official website by typing its address.

Using your rights in practice

• Unwanted advertising: object to direct marketing, which the company must respect, and unsubscribe from lists you do not remember joining.
• Old accounts: delete them and request erasure, which reduces your exposure to data breaches.
• Curiosity: an access request to a service you use heavily often reveals surprising things, such as location history, inferred interests, or contact lists.
• Switching service: use portability to take your photos, playlists or documents to a new service.
• After a leak: ask what data was affected, and take the steps from Chapter 7.

Your turn

Exercise. Choose one service where you have an account that you no longer use (an old shop, forum or app). Find its privacy policy, locate the privacy contact or settings, and send a request to delete your account and data. Record the date.

See a solution

1. Log in (using your password manager) and look in the settings for "delete account" or "download my data". If you want to keep any content, download it first.
2. If there is no option, open the privacy policy, look for the section "your rights" or "contact", and write to the address given using the model message above.
3. Note the date and keep the message. Check that you receive an acknowledgment, and expect a full answer within about a month.
4. If the organization is silent after the deadline, remind them once, then consider a complaint to the data protection authority.
5. Remove the entry from your password manager only after the deletion has been confirmed.

Add to your Security Notebook

Create the heading "5. Privacy and law". Write down the three rights you are most likely to use (for example access, erasure, objection to marketing), the name of your national data protection authority, and the account you will ask to be deleted first.

One of the most visible effects of this law is the cookie banner that appears on almost every website. Let us see what it hides, and how to take control.