110
final and absolute that the data concerned must be erased;
(d) the data has been unlawfully processed.
1a. The application of paragraph 1 shall be dependent upon the ability
of the controller to verify that the person requesting the erasure is the
data subject.
2. Where the controller referred to in paragraph 1 has made the personal
data public without a justification based on Article 6(1), it shall take all
reasonable steps to have the data erased, including by third parties,
without prejudice to Article 77. The controller shall inform the data
subject, where possible, of the action taken by the relevant third parties.
3. The controller and, where applicable, the third party shall carry out the
erasure without delay, except to the extent that the retention of the
personal data is necessary:
(a) for exercising the right of freedom of expression in accordance with
Article 80;
(b) for reasons of public interest in the area of public health in accordance
with Article 81;
(c) for historical, statistical and scientific research purposes in accordance
with Article 83;
(d) for compliance with a legal obligation to retain the personal data by
Union or Member State law to which the controller is subject; Member
State laws shall meet an objective of public interest, respect the right to
the protection of personal data and be proportionate to the legitimate aim
pursued;
(e) in the cases referred to in paragraph 4.
4. Instead of erasure, the controller shall restrict processing of personal
data in such a way that it is not subject to the normal data access and
processing operations and can not be changed anymore, where:
(a) their accuracy is contested by the data subject, for a period enabling
processing or the data subject objects to the processing of personal data
pursuant to Article 19(2)
;
(d)
the processing of the data does not comply with this Regulation for
other reasons.
the data have been unlawfully processed
61
;
(e)
the data have to be erased for compliance with a legal obligation to
which the controller is subject
62
63
.
2.
Where the controller referred to in paragraph 1 has made the
personal data public, it shall take all reasonable steps, including technical
measures, in relation to data for the publication of which the controller is
responsible, to inform third parties which are processing such data, that a
data subject requests them to erase any links to, or copy or replication of
that personal data. Where the controller has authorised a third party
publication of personal data, the controller shall be considered responsible
for that publication.
2a.
Where the controller
64
referred to paragraph 1
has made the
personal data public
65
and is obliged pursuant to paragraph 1 to erase the
data
, the controller, t
aking account of available technology and the cost of
implementation
66
,
it
shall take all
reasonable steps
67
, including technical
measures, in relation to data for the publication of which the controller is
responsible,
to inform third parties
controllers
68
which are processing such
the
data, that a data subject requests them to erase any links to, or copy or
replication of that personal data
69
. Where the controller has authorised a
third party publication of personal data, the controller shall be considered
responsible for that publication.
3.
The controller shall carry out the erasure without delay, except
Paragraphs 1 and 2a shall not apply
70
to the extent that the retention
processing
of the personal data is necessary:
(a)
for exercising the right of freedom of expression in accordance
with Article 80
71
;
( b)
72
for compliance with a legal obligation to retain
process
the
personal data by Union or Member State law to which the controller is
subject
73
or for the performance of a task carried out in the public interest
or in the exercise of official authority vested in the controller
74
; Member
State laws shall meet an objective of public interest, respect the essence of
86
the controller to verify the accuracy of the data;
(b) the controller no longer needs the personal data for the
accomplishment of its task but they have to be maintained for purposes of
proof;
(c) the processing is unlawful and the data subject opposes their erasure
and requests the restriction of their use instead;
(ca) a court or regulatory authority based in the Union has ruled as
final and absolute that the data concerned must be restricted;
(d) the data subject requests to transmit the personal data into another
automated processing system in accordance with paragraphs 2a of Article
15;
(da) the particular type of storage technology does not allow for erasure
and has been installed before the entry into force of this Regulation.
5. Personal data referred to in paragraph 4 may, with the exception of
storage, only be processed for purposes of proof, or with the data subject's
consent, or for the protection of the rights of another natural or legal
person or for an objective of public interest.
6. Where processing of personal data is restricted pursuant to paragraph 4,
the controller shall inform the data subject before lifting the restriction on
processing.
8. Where the erasure is carried out, the controller shall not otherwise
process such personal data.
8a. The controller shall implement mechanisms to ensure that the time
limits established for the erasure of personal data and/or for a periodic
review of the need for the storage of the data are observed.
9. The Commission shall be empowered to adopt, after requesting an
opinion of the European Data Protection Board, delegated acts in
accordance with Article 86 for the purpose of further specifying:
(a) the criteria and requirements for the application of paragraph 1 for
the right to the protection of personal data and be proportionate to the
legitimate aim pursued;
( c)
75
for reasons of public interest in the area of public health in
accordance with Article 81
76
;
(d)
77
for a
rchiving purposes in the public interest or for
historical,
statistical and research
scientific purposes in accordance with Article
[ 83]
78
;
(e)
in the cases referred to in paragraph 4
(g) for the establishment, exercise or defence of legal claims
.
4.
Instead of erasure, the controller shall restrict processing of
personal data where:
(a)
their accuracy is contested by the data subject, for a period
enabling the controller to verify the accuracy of the data;
(b)
the controller no longer needs the personal data for the
accomplishment of its task but they have to be maintained for purposes of
proof;
(c)
the processing is unlawful and the data subject opposes their
erasure and requests the restriction of their use instead;
(d)
the data subject requests to transmit the personal data into another
automated processing system in accordance with Article 18(2).
5.
Personal data referred to in paragraph 4 may, with the exception of
storage, only be processed for purposes of proof, or with the data subject's
consent, or for the protection of the rights of another natural or legal
person or for an objective of public interest.
6.
Where processing of personal data is restricted pursuant to
paragraph 4, the controller shall inform the data subject before lifting the
restriction on processing.
7.
The controller shall implement mechanisms to ensure that the time
limits established for the erasure of personal data and/or for a periodic
review of the need for the storage of the data are observed.
8.
Where the erasure is carried out, the controller shall not otherwise
process such personal data.
9.
The Commission shall be empowered to adopt delegated acts in
accordance with Article 86 for the purpose of further specifying:
55
specific sectors and in specific data processing situations;
(b) the conditions for deleting links, copies or replications of personal data
from publicly available communication services as referred to in
paragraph 2;
(c) the criteria and conditions for restricting the processing of personal
data referred to in paragraph 4.
(a)
the criteria and requirements for the application of paragraph 1 for
specific sectors and in specific data processing situations;
(b)
the conditions for deleting links, copies or replications of personal
data from publicly available communication services as referred to in
paragraph 2;
(c)
the criteria and conditions for restricting the processing of personal
data referred to in paragraph 4
.
Article 17a
Text adopted by Parliament
Consolidated text of the Commission and Council
Right to restriction of processing
1
The data subject shall have the right to obtain from the
controller the restriction of the processing of personal data where:
(a)
the accuracy of the data is contested by the data subject, for a
period enabling the controller to verify the accuracy of the data
79
;
(b)
the controller no longer needs the personal data for the purposes of
the processing, but they are required
by the data subject
for the
establishment, exercise or defence of legal claims; or
(c)
he or she has objected to processing pursuant to Article 19(1)
pending the verification whether the legitimate grounds of the controller
override those of the data subject.
3.
Where processing of personal data has been restricted under
paragraph 1, such data may, with the exception of storage, only be
processed with the data subject's consent or for
the establishment, exercise
or defence of legal claims
or for the protection of the rights of another
natural or legal person or for reasons of important public interest
80
.
4.
A data subject who obtained the restriction of processing
pursuant to paragraph 1 shall be informed by the controller before the
restriction of processing is lifted
81
.
69
Article 17b
Text adopted by Parliament
Consolidated text of the Commission and Council
Notification obligation regarding rectification, erasure or restriction
82
The controller shall communicate any rectification, erasure or restriction
of processing carried out in accordance with Articles 16, 17(1) and 17a to
each recipient
83
to whom the data have been disclosed,
unless this proves
impossible or involves a disproportionate effort.
Article 18
Text adopted by Parliament
Consolidated text of the Commission and Council
deleted
Right to data portability
84
1.
The data subject shall have the right, where personal data are
processed by electronic means and in a structured and commonly used
format, to obtain from the controller a copy of data undergoing processing
in an electronic and structured format which is commonly used and allows
for further use by the data subject.
2.
Where t
T
he data subject has provided the personal data and the
processing is based on consent or on a contract, the data
subject shall have
the right to transmit those
t he
personal data
85
and any other information
provided by the data subject and retained by an automated processing
system, into another one, in an electronic format which is
concerning him
or her
which
he or she has provided to a controller to another controller
in
a commonly used
86
a nd
87
machine-readable format
without hindrance from
the controller from whom the personal data are withdrawn.
to which the
data have been provided to
, where
(a)
the processing is based on consent or on a contract pursuant to
points (a) and (b) of Article 6 (2) or point (a) of Article 9 (2); and
(b)
the processing is carried
out by automated means
88
.
2a.
The exercise of this right shall be without prejudice to Article 17.
2aa.
The right referred to in paragraph 2 shall be without prejudice to
intellectual property rights
in relation to the processing of the those
personal data
89
.
72
3.
The Commission may specify the electronic format referred to in
paragraph 1 and
technical standards, modalities and procedures for the
transmission of personal data pursuant to paragraph 2. Those
implementing acts shall be adopted in accordance with the examination
procedure referred to in Article 87(2).
90
Text adopted by Parliament
Consolidated text of the Commission and Council
[not amended]
SECTION 4: RIGHT TO OBJECT AND
PROFILING
Section 4: Right to object and profiling
Article 19
Text adopted by Parliament
Consolidated text of the Commission and Council
Right to object
1. The data subject shall have the right to object at any time to the
processing of personal data which is based on points (d) and (e) of Article
6(1), unless the controller demonstrates compelling legitimate grounds for
the processing which override the interests or fundamental rights and
freedoms of the data subject.
2. Where the processing of personal data is based on point (f) of Article
6(1), the data subject shall have at any time and without any further
justification, the right to object free of charge in general or for any
particular purpose to the processing of their personal data.
2a. The right referred to in paragraph 2 shall be explicitly offered to the
data subject in an intelligible manner and form, using clear and plain
language, in particular if addressed specifically to a child, and shall be
clearly distinguishable from other information.
Right to object
91
1.
The data subject shall have the right to object, on reasoned
92
grounds relating to their
his or her
particular situation, at any time to the
processing of personal data concerning him or her
which is based on point
(d), (e) and
(f) of Article 6(1)
93
;
the
personal data shall no longer be
processed
unless the controller demonstrates compelling
legitimate
grounds for the processing which override the interests or fundamental
rights and freedoms of the data subject
94
.
1a.
Where an objection is upheld pursuant to paragraph 1, the
controller shall no longer (…)
95
process the personal data concerned
except
for the establishment, exercise or defence of legal claims
96
.
2.
Where personal data are processed for direct marketing
97
purposes,
the data subject shall have the right to object free of charge
at any time
to
the processing of personal data concerning him or her
for such marketing.
97
2b. In the context of the use of information society services, and
notwithstanding Directive 2002/58/EC, the right to object may be
exercised by automated means using a technical standard which allows
the data subject to clearly express his or her wishes.
3. Where an objection is upheld pursuant to paragraphs 1 and 2, the
controller shall no longer use or otherwise process the personal data
concerned for the purposes determined in the objection.
This right shall be explicitly brought to the attention of
the data subject in
an intelligible manner
and shall be presented
clearly distinguishable
and
separately
from any
other information
98
.
2a.
Where the data subject objects to the processing for direct
marketing purposes, the personal data shall no longer be processed for
such purposes.
3.
Where an objection is upheld pursuant to paragraphs 1 and 2, the
controller shall no longer use or otherwise process the personal data
concerned.
Article 20
Text adopted by Parliament
Consolidated text of the Commission and Council
Profiling
1. Without prejudice to the provisions in Article 6 every natural person
shall have the right to object to profiling in accordance with Article 19.
The data subject shall be informed about the right to object to profiling
in a highly visible manner.
2. Subject to the other provisions of this Regulation, a person may be
subjected to profiling which leads to measures producing legal effects
concerning the data subject or does similarly significantly affect the
interests, rights or freedoms of the concerned data subject only if the
processing:
(a) is necessary for the entering into, or performance of, a contract, where
the request for the entering into or the performance of the contract, lodged
by the data subject, has been satisfied, provided that suitable measures to
safeguard the data subject's legitimate interests have been adduced; or
(b) is expressly authorized by a Union or Member State law which also
lays down suitable measures to safeguard the data subject's legitimate
interests;
(c) is based on the data subject's consent, subject to the conditions laid
down in Article 7 and to suitable safeguards.
Measures based on
P
rofiling
99
1.
Every natural person
T he
data subject
shall have the right not to be
subject to a measure
which
decision
evaluating personal aspects relating
to him or her, which is based solely on
automated processing, including
profiling,
a nd
produces legal effects
concerning this natural person or
significantly affects this natural person, and which is based solely on
automated processing intended to evaluate certain personal aspects
relating to this natural person or to
analyse or predict in particular the
natural person's performance at work, economic situation, location, health,
personal preferences, reliability or behaviour
him or her or significantly
100
affects him or her.
1a
.
101
Subject to the other provisions of this Regulation, a person may be
subjected to a
measure
of the kind
A data subject may be subject to a
decision
]
referred to in paragraph 1 only if the
processing it
(a)
is carried out in the course of the
necessary for
entering into, or
performance of, a contract where the request for the entering into or the
performance of the contract, lodged by the data subject,
has been satisfied
or
where suitable measures to safeguard the data subject's legitimate
78
3. Profiling that has the effect of discriminating against individuals on
the basis of race or ethnic origin, political opinions, religion or beliefs,
trade union membership, sexual orientation or gender identity, or that
results in measures which have such effect, shall be prohibited. The
controller shall implement effective protection against possible
discrimination resulting from profiling. Profiling shall not be based
solely on the special categories of personal data referred to in Article 9.
5. Profiling which leads to measures producing legal effects concerning
the data subject or does similarly significantly affect the interests, rights
or freedoms of the concerned data subject shall not be based solely or
predominantly on automated processing and shall include human
assessment, including an explanation of the decision reached after such
an assessment. The suitable measures to safeguard the data subject's
legitimate interests referred to in paragraph 2 shall include the right to
obtain human assessment and an explanation of the decision reached
after such assessment.
5a. The European Data Protection Board shall be entrusted with the
task of issuing guidelines, recommendations and best practices in
accordance with point (b) of Article 66 (1) for further specifying the
criteria and conditions for profiling pursuant to paragraph 2.
interests have been adduced, such as the right to obtain human
intervention
between the data subject and a data controller
102
;
or
(b)
is expressly
authorized by Union or Member State law to which
the controller is subject and
which also lays down suitable measures to
safeguard the data subject's legitimate interests; or
(c)
is based on the data subject's explicit
consent, subject to the
conditions laid down in Article 7 and to suitable safeguards
.
1b
. In cases referred to in paragraph 1a) the data controller shall
implement suitable measures to safeguard the data subject’s rights and
freedoms and legitimate interests, such as the right to obtain human
intervention on the part of the controller, to express his or her point of
view and to contest the decision
103
:
2.
104
Subject to the other provisions of this Regulation, a person may be
subjected to a measure of the kind referred to in paragraph 1 only if the
processing:
(a) is carried out in the course of the entering into, or performance of, a
contract, where the request for the entering into or the performance of the
contract, lodged by the data subject, has been satisfied or where suitable
measures to safeguard the data subject's legitimate interests have been
adduced, such as the right to obtain human intervention; or
(b) is expressly authorized by a Union or Member State law which also
lays down suitable measures to safeguard the data subject's legitimate
interests; or
(c) is based on the data subject's consent, subject to the conditions laid
down in Article 7 and to suitable safeguards.
3.
Automated processing of personal data intended to evaluate certain
personal aspects relating to a natural person shall not be based
solely
on
the special categories of personal data referred to in Article 9.
Decisions referred to in paragraph 1a shall not be based on special
categories of personal data referred to in Article 9(1),
unless points (a) or
(g) of
Article 9(2) apply
and suitable measures to safeguard the data
subject's legitimate interests
105
are in place.
4.
In the cases referred to in paragraph 2, the information to be
provided by the controller under Article 14 shall include information as to
Documents you may be interested
Documents you may be interested
