Rights for individuals

Rights for individuals.

One of the key changes brought about by GDPR is the introduction of new rights and the strengthening of existing rights to give individuals more control on how organisations process their data. The rights GDPR provides to individuals are:

Right to be informed

Individuals have the right to be informed about the collection and use of their personal data. ‘Privacy information’ explaining how an individual’s data is processed, how long it is retained for and who it is shared with must be provided at the time data is collected, for example, on or in conjunction with, the sales and finance agreement. This information is usually known as a ‘Data Privacy Notice’ or DPN.

Return

Right of access

Individuals have the right to access their personal data and any supplementary information that is held or has been processed by an organisation. A reasonable fee can be charged only if the request is unfounded or excessive, otherwise it must be provided free of charge without undue delay within one month of the request being made.

Return

Right to rectification

Individuals have the right to have inaccurate personal data rectified, or completed if inaccurate. A request can be made verbally or in writing and must be responded to within one month. In certain circumstances requests can be refused.

Return

Right to erasure

Individuals have a right to have their personal data erased. This is known as the ‘right to be forgotten’. A request can be made verbally or in writing and must be responded to within one month. The right only applies in certain circumstances.

Return

Right to restrict processing

Individuals have the right to request the restriction or suppression of their personal data. This allows for their data to be stored but not used. A request can be made verbally or in writing and must be responded to within one month. The right only applies in certain circumstances.

Return

Right to data portability

Individuals have the right to obtain and reuse their personal data for their own purposes across different services. This allows them to move, copy or transfer personal data across IT platforms for convenience in a way that is portable and safe. This information must be provided free of charge, without undue delay, and within one month of being requested.

Return

Right to object

Individuals have the right to object to their personal data being processed for direct marketing purposes (including profiling). The right to object must be included in the initial privacy notice provided to the individual.

Return

Rights related to automated decision making and profiling

Individuals have a right not to be subject to an automated decision making process or profiling unless the decision is necessary for the entry into or performance of a contract. Since affordability and creditworthiness checks are a requirement for finance providers to undertake, individuals would not always be entitled to exercise this right where data is being used for a credit application.

Return