Data Subject Rights under the GDPR

Author(s):  
Helena U. Vrabec

In 2018, the GDPR started a revolution in the data protection world. One of the most far-reaching developments of the new regulation was the chapter on data subject rights. Old rights were strengthened and extended, and several new rights were introduced. For data subjects who felt overwhelmed with the information overload, the GDPR meant a promise of more individual control over data. In combination with severe financial penalties, the revised rights brought the potential to become a vehicle of data protection law enforcement. However, there are still many uncertainties related to data subject rights due to the fact that the GDPR only recently entered into force. The Court of Justice of the EU and other EU governmental authorities have not yet had the time to provide thorough and updated guidance (although the court has been actively adjudicating on these individual rights ever since the GDPR was adopted). Not only is the lack of guidance a problem, the applicability of data subject rights is strongly influenced by the economic and social (data-driven) context. This book provides a thorough analysis of data subject rights under the new GDPR framework and their legal operation. The goal is to help individuals (lawyers and others) to navigate the subject area and/or possibly pursue claims. Its additional value is that it considers the rights in a big data environment and therefore more accurately points out inefficiencies and provides criticism where needed.

2021 ◽  
Vol 11 (2) ◽  
pp. 148-166
Author(s):  
Rastislav Funta ◽  
Peter Ondria

Abstract The redesign of data protection in the police and judicial area is intended to create uniformity at the European level for the citizens of EU Member States. This scientific article analyses the subject of data protection in law enforcement and judicial cooperation in criminal matters. The focus is primarily on the existing provisions and the latest developments of the EU with regard to Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. The international level with regard to data protection in the police and judicial area and possible changes due to the developments in data protection under European law are also examined in more detail.


Author(s):  
Maria Tzanou

This chapter provides an analysis of the data protection rules in EU law, focusing on the constitutional and legal developments after the entry into force of the Lisbon Treaty. It examines the jurisprudence of the Court of Justice of the EU on data protection issues, including the recent decisions of the Court on metadata retention and the new right to be forgotten. It concludes with a critical comment on the possibilities and limitations of the EU to provide for effective and comprehensive data protection.


2020 ◽  
Vol 22 (2) ◽  
pp. 139-177
Author(s):  
Niovi Vavoula

Abstract Since the past three decades, an elaborate framework of EU-wide information systems processing the personal data of third-country nationals has emerged. The vast majority of these systems (VIS, Eurodac, EES, ETIAS) are conceptualised as multi-purpose tools, whereby their consultation for crime-related objectives is listed among their ancillary objectives. As a result, immigration records may be accessed by national law enforcement authorities and Europol for the purposes of fighting terrorism and other serious crimes under specified and limited conditions. Drawing from the relevant jurisprudence of the European Court, this article evaluates whether the EU rules on law enforcement access to EU immigration databases comply with the rights to respect for private life and protection of personal data, as enshrined in Article 7 and 8 of the EU Charter respectively. In addition, challenges posed by the forthcoming interoperability between databases are also examined.


2018 ◽  
Vol 12 (2) ◽  
pp. 221-246
Author(s):  
Angela Sobolčiaková

The paper discusses the right to obtain a copy of personal data based on the access right guaranteed in Articles 15 (3) and limited in 15 (4) of the GDPR. Main question is to what extent, the access right provided to data subject under the data protection rules is compatible with copyright. We argue that the subject matter of Article 15 (3) of the GDPR - copy of personal data – may infringe copyright protection of third parties but not a copyright protection attributed to the data controllers.Firstly, because the right of access and copyright may be in certain circumstances incompatible. Secondly, the data controllers are primarily responsible for balancing conflicting rights and neutral balancing exercise could only be applied by the Data Protection Authorities. Thirdly, the case law of the CJEU regarding this issue will need to be developed because the copy as a result of access right may be considered as a new element in data protection law.


2021 ◽  
Vol 16 (8) ◽  
pp. 160-172
Author(s):  
A. O. Chetverikov

The paper analyzes the provisions of the legislation and the latest court practice of the European Court of Justice (ECJ) regulating the procedure for refusing to issue Schengen visas and other migration permits necessary for foreign scientists to participate in experiments using unique European mega-science facilities, as well as in other scientific events in the EU. The first section "Visa refusal and the right to appeal it in the EU: Historical and comparative legal aspects" examines the formation and initial content of the EU rules on the rationale and appeal of the refusal of Schengen visas, starting with the Schengen agreements of the 1980s and before the adoption of the 2009 EU Visa Code. The second section "Right to appeal against refusal of Schengen and equivalent visas" is devoted to the rules of the 2009 EU Visa Code regarding visas for short-term stays (up to 90 days within a period of 180 days), amended and supplemented by the 2017 EU Court of Justice prejudicial decision as in the case of "El Hassani" regarding the recognition of foreigners’ right to judicial appeal against a visa refusal and, in a broader context, "the right to a fair and adequate consideration of their application" for a visa. The subject of the third, final section "The right to appeal the refusal of visas for long-term stay and residence permits" are the provisions of the latest ECJ court practice (judgment in the case of "M.A." of 10.03.2021), which made it possible to challenge in the courts of the EU Member States refusals to issue even those migration permits that are issued in accordance with national law.


Author(s):  
Fabiana Accardo

The purpose of this article is that to explain the impact of the landmark decision Schrems c. Data Protection Commissioner [Ireland] - delivered on 7 October 2015 (Case C-362/2014 EU) by the Court of Justice - on the European scenario. Starting from a brief analysis of the major outcomes originated from the pronunciation of the Court of Justice, then it tries to study the level of criticality that the Safe Harbor Agreement and the subsequently adequacy Commission decision 2000/520/EC – that has been invalidated with Schrems judgment – have provoked before this pronunciation on the matter of safeguarding personal privacy of european citizens when their personal data are transferred outside the European Union, in particular the reference is at the US context. Moreover it focuses on the most important aspects of the new EU-US agreement called Privacy Shield: it can be really considered the safer solution for data sharing in the light of the closer implementation of the Regulation (EU) 2016/679, which will take the place of the Directive 95 /46/CE on the EU data protection law?


Author(s):  
Edward L. Carter

The right to be forgotten is an emerging legal concept allowing individuals control over their online identities by demanding that Internet search engines remove certain results. The right has been supported by the European Court of Justice, some judges in Argentina, and data-protection regulators in several European countries, among others. The right is primarily grounded in notions of privacy and data protection but also relates to intellectual property, reputation, and right of publicity. Scholars and courts cite, as an intellectual if not legal root for the right to be forgotten, the legal principle that convicted criminals whose sentences are completed should not continually be publicly linked with their crimes. Critics contend that the right to be forgotten stands in conflict with freedom of expression and can lead to revisionist history. Scholars and others in the southern cone of South America, in particular, have decried the right to be forgotten because it could allow perpetrators of mass human rights abuses to cover up or obscure their atrocities. On the other hand, those in favor of the right to be forgotten say that digital technology preserves memory unnaturally and can impede forgiveness and individual progress. The right to be forgotten debate is far from resolved and poses difficult questions about access to, and control of, large amounts of digital information across national borders. Given the global nature of the Internet and the ubiquity of certain powerful search engines, the questions at issue are universal, but solutions thus far have been piecemeal. Although a 2014 decision by the Court of Justice of the European Union (EU) garnered much attention, the right to be forgotten has been largely shaped by a 1995 European Union Directive on Data Protection. In 2016, the EU adopted a new General Data Protection Regulation that will take effect in 2018 and could have a major impact because it contains an explicit right to be forgotten (also called right to erasure). The new regulation does not focus on the theoretical or philosophical justification for a right to be forgotten, and it appears likely the debate over the right in the EU and beyond will not be resolved even when the new rule takes effect.


2019 ◽  
Vol 15 (2) ◽  
pp. 162-176 ◽  
Author(s):  
Orla Lynskey

AbstractThis paper examines the application of the latest iterations of EU data protection law – in the General Data Protection Regulation, the Law Enforcement Directive and the jurisprudence of the Court of Justice of the EU – to the use of predictive policing technologies. It suggests that the protection offered by this legal framework to those impacted by predictive policing technologies is, at best, precarious. Whether predictive policing technologies fall within the scope of the data protection rules is uncertain, even in light of the expansive interpretation of these rules by the Court of Justice of the EU. Such a determination would require a context-specific assessment that individuals will be ill-placed to conduct. Moreover, even should the rules apply, the substantive protection offered by the prohibition against automated decision-making can be easily sidestepped and is subject to significant caveats. Again, this points to the conclusion that the protection offered by this framework may be more illusory than real. This being so, there are some fundamental questions to be answered – including the question of whether we should be building predictive policing technologies at all.


2019 ◽  
Vol 10 (1) ◽  
pp. 34-43
Author(s):  
Paul De Hert ◽  
Vagelis Papakonstantinou

The European Public Prosecutor’s Office (the ‘EPPO’) necessarily processes personal data in order to fulfil its mission; As such, it falls squarely within the European Union (EU) data protection regulatory landscape. However, because the EU data protection regulatory landscape itself is currently found at a crossroads, an analysis of the EPPO data protection model may be twofold: First, placing it within the proper cross-organization dialogue currently taking place on the future regulatory model of personal data processing for law enforcement purposes carried out at EU level. Second, at an EPPO-specific level, whereby the actual data protection regime afforded to it may be assessed. This article purports to elaborate upon the above two data protection dimensions of EPPO personal data processing activities: It presents considerations and policy options during the lawmaking period that resulted in the establishment of the EPPO, it analyses the data protection regime ultimately awarded to it and attempts to, critically, place the EPPO data protection model within its proper operational and legislative environment.


Sign in / Sign up

Export Citation Format

Share Document