Personal Data : definitions, processings & retention

In other words, organizations may only collect personal data for specific purposes and proportionate to these purposes. They are therefore required to indicate the type of data collected and the reasons why such collection is necessary.

This ensures full transparency between the data controller, the originator of the collection, and the data subject, and provides better data protection guarantees.

Use cases

The GDPR states that recording, storing or consulting personal data is part of processing. This means that the GDPR may apply to any operation, even those that are seemingly passive, such as visiting a website.

Each individual can exercise their right:

• to transparency on what is and will be done with their data
• to rectify incorrect data and delete certain data
• to object to processing, particularly in the case of profiling
• to have their data returned to them

By guaranteeing these rights, organizations pave their way toward GDPR compliance. Every action taken must be in line with these rights. They must set up processes that protect these rights and ensure that individuals retain control over their privacy.

Any person whose data is processed has a right to be informed.

The right to be informed is the right to demand that the entity processing your data be transparent with regard to both the processing carried out and your rights relating to your data.

The information that must be provided must answer the following questions:

• Why: why is my data being processed?
• How: what do you do with my data, and for how long?
• To whom: to whom do you communicate my data?

What can I do about it: what are my rights regarding your processing and how can I object to it?

The GDPR does not state specifically how the information resulting from the right to be informed should be communicated, but it does require that it be communicated at the precise moment the data is collected, and that it be easily accessible, understandable and formulated in clear terms. Information that is buried in small print within general terms & conditions or is couched in legalese does not comply with the requirement for clear and instructive information.

The watchword here is clarity. All users, regardless of their legal awareness, must be able to make decisions with full knowledge of the facts.

They must have all the keys allowing them to exercise control over their personal data.

To observe this fundamental right, the data subject must be aware of:

• the purposeof the data collection and whether it is mandatory or optional
• the identity of the controller
• the recipients of the data
• any data transfers outside the European Union
• the rights that they can exercise to retain control over their data

These are the first main items of information to be described in a privacy policy.

The more sensitive or extensive the data processing, the more the information provided for exercising the right to be informed must be clear and comprehensive.

For instance, for a relatively small merchant website, a privacy policy of 3 to 4 pages available at the bottom of each page and providing the information in clear language is sufficient.

However, for a company such as Google, the information must be comprehensive, precise and clear, and allow navigating via links and pop-up menus. Users must be able to control the confidentiality settings for their personal information vis-à-vis Google and third parties in several different ways.

It was this lack of precision, clarity and configurability of Google’s privacy policy that led the French Authority to fine the company.

What information should be communicated to data subjects?

1. Information collected directly from the data subject

Article 13 paragraph 1 provides that the data controller must provide the following information:

• The identity and contact details of the controller and, where applicable, of the controller’s representative
• The contact details of the data protection officer (DPO), where applicable
• The purposes of the processing for which the personal data is intended as well as the legal basis for the processing
• The external recipients of this data (service providers, suppliers, partners, etc.)
• The legitimate interests pursued by the controller, if the processing has this basis.

Furthermore, in order to guarantee fair and transparent processing of personal data, paragraph 2 of said article requires that the controller provide additional information, namely:

The length of time the personal data will be kept or, if this information is not available, the criteria used to determine the length of time.

the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

For consent-based processing, existence of the right to withdraw consent at any time, without prejudice to the lawfulness of the processing carried out prior to withdrawal of consent.

• The right to lodge a complaint with a supervisory authority.
• Information on whether the requirement to provide personal data is statutory or contractual or whether it is a condition for the conclusion of a contract, and whether the data subject is required to provide the personal data, as well as information on the possible consequences of not providing such data.
• The existence of automated decision-making, including profiling – which has legal effects on the data subject and which may process special categories of data – or at least useful information about the underlying logic, as well as the significance and the intended consequences of such processing for the data subject.

2. Information collected indirectly

Article 14 contains the same list as Article 13, but also includes a subtler point. Indeed, in the case of indirect collection of personal data, the controller must provide the categories of personal data concerned by the processing.

Furthermore, when providing additional information, the controller must provide “the source from which the personal data originates and, and if applicable, a statement as to whether or not it came from publicly available sources” (Article 14(2)).

When must this information be provided?

If the data was collected directly from the data subject, the information must be provided at the time the data was obtained.

If, on the other hand, the data was collected indirectly, the controller must provide the data subject with the information:

• Within a reasonable period of time not exceeding 1 month, taking into account the specific circumstances in which the data is processed
• If the controller uses a data subject’s data for the purpose of communicating with them, the information must be provided at the time of the first communication.

Described in Article 15 of the General Data Protection Regulation, the GDPR right of access is the counterpart of the right to be informed.

By exercising the right of access under the GDPR, an individual requests information from the entity processing their data that is more or less the same as the information that must be provided at the time of data collection. However, whereas the right to be informed gives an individual the initial information all at once, the right of access allows an individual to control what is actually being done with their personal data, in real time, at any given moment.

The right of access is a data subject’s best way to verify that their personal data is not being used beyond what could reasonably be expected. If its use is no longer appropriate, or if an individual feels that the entity has not provided them with all the information required, they may exercise other rights such as the right to erasure, or even file a complaint with the supervisory authority.

Indeed, the power of the right of access is that it is unconditional, as long as the request is not obviously abusive (for example, is not the umpteenth request concerning the same data within a short period of time).

The entity is obliged to comply with the request and to deliver the information within a period of one month, which may be extended to two months in case of legitimate circumstances to be justified by the entity.

Use case

Let’s take the typical example of a real estate agency that conducts processing for contractual purposes on the one hand, and marketing on the other.

An owner has hired the real estate agency to manage their property rental. At the end of the lease, the owner terminates the rental management contract with the agency. However, the owner continues to receive commercial offers from the agency by email. Noticing that the offers clearly target their situation, and in order to know what information the agency holds, they exercise their right of access.

In response, the agency sends them all the data it possesses on them. The owner receives confirmation that their personal data should not have been processed for marketing purposes, in particular data relating to their financial and family situation. The owner then decides to withdraw their consent to the processing of their data and to exercise their right to erasure of their data, arguing that the contract had been terminated.

The agency proceeds with the deletion but informs the owner that the data strictly related to the rental management contract will be archived for a certain period of time corresponding to the contractual limitation period. It confirms that all other data has been deleted and that the owner will no longer receive commercial offers.

More specifically, a person exercising their right of access may request the following information:

• the purposes of the processing
• the categories of data concerned
• the recipients or categories of recipients to whom the data has been or will be disclosed, in particular recipients who are established in third countries or international organizations
• where possible, the period for which the data will be kept or, where this is not possible, the criteria used to determine this period
• the existence of the right to request from the controller the rectification or erasure of data, a restriction on the processing of data relating to the data subject, or the right to object to such processing
• the right to lodge a complaint with a supervisory authority
• if the data was not collected from the data subject, any available information about their source
• the existence of automated decision-making, such as profiling. In such cases, data subjects are also entitled to request any relevant information concerning the underlying logic, significance and intended consequences of the processing for them.

The subject may request a copy of their data being processed. In this case, the data controller may charge a reasonable fee, based on the complexity and amount of data, and the administrative costs incurred.

Misleading or erroneous personal information used by an organization can lead to negative consequences, especially when it comes to the communication or storage of this data. In some cases, the person will want to have it corrected or completed. This is where the right to rectification comes into play.

The principle from which this right derives is the principle of fairness: if a third party processes my data, I have the right to demand that this personal data be “accurate, complete and, if necessary, kept up to date” in view of the purposes of the processing.

As with the right of access, this right is not subject to any conditions other than proof that the information is inaccurate. Moreover, the request must not be obviously abusive.

This right can also be exercised in the event of “digital death“: the personal data of a deceased person can be modified or completed by their beneficiaries, who make a request to the controller.

If the data has several recipients, the controller is required to transmit the rectifications to all the actors concerned.

Use case

Incorrect information on a form may lead a company to make a calculation that may be prejudicial to you, for example if it is used to calculate a refund or benefit whose estimation could be lower than the correct amount.

The same applies to information made available to the public, for example on a website: it must be possible to rectify incorrect information on your medical record.

Find out more

What are the conditions for exercising the right to rectification?

Article 12 of the GDPR governs the procedures for the right to rectification, which is described in Article 16 of the GDPR.

The data subject must first prove that their data is inaccurate, incomplete, out of date or equivocal. The controller must then validate the evidence provided by the data subject and inform the data subject of the rectification as soon as possible. The burden of proof in this case lies with the controller.

How does a data subject exercise their right to rectification?

The data subject must apply directly to the controller (they may also apply to the Data Protection Officer) to satisfy this request. The latter may require proof of the data subject’s identity or other types of proof (though they are prohibited from requesting a disproportionate number of documents).

Exercising this right is free of charge for the data subject and is the responsibility of the data controller and/or processor, who must demonstrate that they are handling the request as quickly as possible (1 to 3 months depending on the complexity of the request).

If your organization does not respond quickly enough, or fails to respond, the data subject has the right to request “restriction of processing” (prohibition of all processing of the data concerned), and may lodge a complaint with the supervisory authority.

Limits to the right to rectification

The right to rectification cannot be applied to the processing of journalistic, artistic or literary data. Moreover, in order to protect the confidentiality of investigations, processing relating to police, intelligence and national bank account listings agencies is excluded from the scope of this right.