Since May 2018, the UK's General Data Protection Regulation (GDPR) has given everyone extra data privacy rights. But what are those rights, and what do they mean for you?
In this guide:
- The right to be informed
- The right of access
- The right to data portability
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right object to ‘automated decisions’
- What can I do if my rights are breached?
The right to be informed
Before they collect and store your data, organisations must tell you:
- why they’re doing it,
- how long they’ll keep it for, and
- who it will be shared with.
They will ask you for your consent before they can send you any marketing messages. You can withdraw this consent at any time.
Companies can still send you messages with information they feel you need to know. For example, your home insurer could still send you information about your renewal, any claims you’ve made, or tips on how to access the services you’re already paying for.
The right of access
You have the right to ask for the data a company holds on you. The company should then share the data they have with you, free of charge, within a month of your request. This makes it much easier for you to see what data a company has collected about you and why.
The right to data portability
You can ask for a copy of your data in a ‘commonly used’ format that doesn’t need special software to access.
For example, you might ask for your data from your bank. Banks collect transaction data. With your own copy of this data, you can help price comparison sites to predict which companies will give you a cheaper or better service.
The right to rectification
If a company has your data wrong or is missing key information, you can ask them to put it right.
When you send them up-to-date information, the company must sort it within a month (or longer if the information is complex). They’ll also have to forward the updates to everyone they share your data with. This makes sure you aren’t misrepresented, and that insurers like AXA can give you the most accurate quotes.
The right to erasure
If you want to stop dealing with an organisation, or your life has changed significantly, you can ask for your data to be deleted. This is also known as the ‘right to be forgotten’.
Companies with your data will have to go along with your request unless they have a ‘compelling reason’ to hang on to your information.
Because of this right, when you unsubscribe from a service (like a social media platform), you can ask them to delete your personal information from their databases.
The right to restrict processing
Unsure about an organisation’s behaviour or motives but don’t want to cut all ties? GDPR gives you the ability to tell them to stop using your data without forcing them to delete what they already have. In legal terms, this is called ‘restricting processing’.
The right object to ‘automated decisions’
An ‘automated decision’ is when your data is used to help decide if you’re eligible for products like loans, insurance or mortgages. This rule gives you the right for human intervention if you think you’re being unfairly treated based on an automated decision.
What can I do if my rights are breached?
If you’re worried about how an organisation is using your data, or suspect they aren’t complying with these rights, contact the Information Commissioner’s Office (ICO).
