Right to access

The exercise of the right to access allows you to know if your personal data are processed and to obtain their communication in an understandable format.

The right to access allows to access the personal data and, if necessary, to have them rectified or deleted.

The entity from which you request your "right to access" will have to provide you with a copy of your personal data it holds and inform you of:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients who may have had access to these data;
  • the length of time the data are stored or the criteria for determining this length of time;
  • the existence of other rights (right to rectification, deletion, limitation, opposition);
  • the possibility to submit a request to the CNIL;
  • any information relating to the source of the data collected if it has not been directly collected from you;
  • the existence of automated decision‑making, including profiling, and the underlying logic, as well as the significance and the envisaged consequences of such processing for you;
  • the possible transfer of your data to a third country (non‑EU member) or to an international organization.

For more information:

https://www.cnil.fr/fr/le-droit-dacces-connaitre-les-donnees-quun-organisme-detient-sur-vous

https://www.cnil.fr/en/sheet-ndeg13-prepare-exercise-peoples-rights

Article 15 GDPR

Articles 39, 40‑1 to 43 Data Protection Act

Right to rectification

The right to rectification enables the editing of inaccurate data concerning you (wrong age or address) or to complete them (address without flat number) in relation to the purpose of the processing.

For more information:

https://www.cnil.fr/fr/le-droit-de-rectification-corriger-vos-informations

https://www.cnil.fr/en/sheet-ndeg13-prepare-exercise-peoples-rights

Article 16 GDPR

Articles 40 to 42 Data Protection Act

Right to erasure (‘right to be forgotten’)

The person whose data are being processed shall have the right to obtain their erasure, and the person responsible for processing the data is obliged to do so without undue delay when one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the person withdraws her/his consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and there is no other legal ground for the processing;
  • the person objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the person objects to the processing pursuant to Article 21(2);
  • the personal data have been unlawfully processed;
  • the personal data have to be erased in order to comply with a legal obligation in the European Union or Member State law governing the person responsible for the processing;
  • the personal data have been collected in relation to the offer of Information companies referred to in Article 8(1).

For more information:

Article 17 GDPR

Right to restrict processing

The person shall have the right to obtain a limited processing of his/her personal data from the person responsible for handling them in one of the following situations:

  • the accuracy of the personal data is disputed by the person whose data are being processed,  for the time needed by the person responsible for the processing to verify them;
  • the processing is unlawful and the person, who opposes the erasure of the personal data, requests the restriction of their use instead;
  • the person responsible for the processing no longer needs his/her personal data for the purposes of the processing, but they are required by he/she for the establishment, exercise or defence of legal claims;
  • the person concerned by the processing has objected to their use pursuant to Article 21(1), for the time needed to determine whether the legitimate grounds of the person responsible for the processing overrides his/her rights.

For more information:

Article 18 GDPR

Right to object

Are your personal data appearing in a non‑mandatory file and you wish to delete them? The right to object allows you to refrain your data from being used by an entity for a specific purpose. You have to set out "convincing elements relating to your particular situation", except in the case of commercial prospecting, to which you can object without giving any reason.

For more information:

https://www.cnil.fr/fr/le-droit-dopposition-refuser-lutilisation-de-vos-donnees

https://www.cnil.fr/en/sheet-ndeg13-prepare-exercise-peoples-rights

Article 21 GDPR

Articles 38 and 40‑1 Data Protection Act

Right to data portability

The person shall have the right to receive her/his personal data, which he/she has provided to a person responsible for the processing, in a structured, commonly used and computer‑readable format and have the right to transmit them to another responsible of the processing of data without causing any hindrance where:

  • the processing is based on consent pursuant to point ( of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1);
  • the processing is carried out by automated means.

For more information:

Article 20 GDPR

The right to define instructions after death

For more information:

Articles 40 Data Protection Act

The enforcement of this right is subject to a decree which has not yet been adopted.

The right not to be subject to a decision based solely on automated processing

1.   The person shall have the right not to be submitted to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects her.

2.   Paragraph 1 shall not apply if the decision:

a) is necessary for entering into, or performance of, a contract between the person and the person responsible for the processing;

b) is authorised by the European Union’s or a Member’s State law which is governing the person responsible for the processing and lays down suitable measures to safeguard the person’s rights and freedoms and legitimate interests; or

c) is based on the data person’s explicit consent.

For more information:

Article 22 GDPR

Articles 10 Data Protection Act