Home -> Law Blog Directory -> Intellectual Property Law Blogs -> IBLS Internet Law Blog

Intellectual Property Law

: IBLS Internet Law Blog

Data Subject Rights in the Processing of Personal Data by EU Community Institutions

By Martha L. Arias

EC Regulation 45/2001 of December 18, 2000, set up rules for "the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data." The European Parliament and Council issued this regulation following the mandates in the Treaty establishing the European Community (ECT).  Indeed, the ECT ordered protection of personal data, the establishment of data subject rights, delimitation of the Community bodies' obligations when processing personal data, the establishment of appropriate sanctions for offenders, and the establishment of an independent supervisory body that monitors the application of data protection acts.     

 

EC Regulation 45/2001 applies to the protection of personal data processed by any Community institution or body in any context. It applies to data concerning an identified or identifiable person; data rendered anonymously when the data subject is not longer identifiable is not protected by this law.  The preamble of EC Regulation 45/2001 considers the protection of personal data part of an individual's privacy and fundamental rights and freedom.  Liability for violation of this regulation is controlled by ECT, article 288.  The European Data Protection Supervisor may order the monitoring of Community institutions' or bodies' networks to prevent any unauthorized use of personal data.  Data protection officers in Community institutions and bodies ought to monitor compliance of these Regulation's rules. Section 5, articles 13 to 19, expressly lists the data subject rights under this EC data protection regulation. 

The EC Regulation 45/2001 conveys seven rights on data subjects:

1. Right of Access.  Data subjects have the right to obtain from the Community data controller, without constrain and free of charge, (a) a confirmation of whether his data is being processed; (b) information about the purpose, categories, and recipients of the data being processed; (c) intelligible communication about the data processed and any other available information regarding the collection source; and (d) information on any automatic decision process concerning data.  The above information must be provided to the data subject within three months from the requesting date.  Therefore and according to this right, any European has the right to request information on the personal data being processed by any Community institution or body.  This article does not establish to whom a data subject may direct its request.  However, as the preamble says, "data protection officers" are in charge of assuring compliance of data protection laws within Community institutions.

2.  Rectification Right.  Data subjects have the right to obtain rectification of their personal data from the controller of such data and without delay.

3.  Blocking Right.  Data subjects may request and obtain the blocking of their personal data when (a) the data subject contends its accuracy or completeness; (b) the controller no longer needs the data, unless it requires keeping it for evidentiary purposes; and (c) the data processing is unlawful and the data subject demands blocking the data instead of deleting it.   When blocking personal data is ordered, automatic systems should include technical means to obstruct the use of such data.  Community institutions can only process blocked data for proof purposes, or with the data subject's consent, or for the protection of a third party's rights. 

4. Erasure Right.  Data subjects may request personal data deletion when the processing of such data is unlawful. 

5. Right of Notification to Third Parties.  The data subject has the right, unless it becomes a disproportionate effort for the controller, to obtain the controller's notification to third parties to whom the data was disclosed, about rectification, deletion, or blocking of the data.

6.  Right to Object.  Data subjects have the right to object, at any time, to the processing of their personal data, with some exceptions; they also have the right to object the use of their personal data for direct marketing. 

7.  Rights related to Automated Individual Decisions.     Data subjects have the right to object to the automated processing of their data that produces legal effects and directly affect them, e.i., data related to work performance and reliability or conduct; unless this processing is authorized by national or Community law or by the European Data Protection Supervisor.   In either of the above cases, Community institutions using automated processing of data must afford data subjects the right to present their opposing views. 

Full post as published by IBLS Internet Law Blog on August 11, 2008 (boomark / email).