While some of these rights are an extension of what is currently afforded to data subjects under the existing data protection regime, others represent completely new concepts.
For instance, lots of businesses will be surprised to hear that their right to charge an administration fee for dealing with data subject access requests has now been abolished (unless the request is unfounded or excessive), as this acted as a useful deterrent against time wasters looking to cause bother.
A summary of the new rights which will be available after 25 May 2018 are as follows:
So what are the implications for businesses? For example, if you are a software provider, you may receive a request from a data subject asking you to transfer their personal data to a new software provider. You might also receive a request from a data subject asking you to delete all personal data that you hold about them.
To ensure compliance (and avoid potentially hefty fines), all businesses will need to train staff to ensure that they are properly versed in dealing with the data subject’s request. They will need to review existing policies and procedures to ensure that they are compliant with the new GDPR rules and they will need to assess whether their computer systems are sufficient to deal with the rights (e.g. the right to erasure and the right to data portability).
While the new GDPR is a major step forward in enhancing data subject’s rights, it will be a time consuming and potentially expensive exercise for businesses.
If you wish to discuss any of the issues raised in this article or would like assistance with complying with the new GDPR please contact Rebecca Anforth, head of Intellectual Property, on 01872 226999 or firstname.lastname@example.org.
The information provided in this article is for general information purposes only and does not constitute legal or other professional advice and cannot be relied upon as such. Any law quoted in this article is correct at 22 March 2018. Appropriate legal advice should be sought for specific circumstances before any action is taken. Copyright © Murrell Associates Limited 2018.