The General Data Protection Regulation (GDPR) is a landmark in privacy and personal data protection law in the European Union (EU). Applicable since 25 May 2018, the GDPR established a robust set of rules for protecting personal data in the EU. In doing so, it guarantees the right to data protection and the other fundamental freedoms of natural persons, regardless of their nationality or place of residence.
The right to data protection in the GDPR
In this article, we explore the right to personal data protection as set out in the GDPR. To do so, we analyse its main principles, the rights of data subjects and the responsibilities of organisations. We also address the impact of this regulation on the global privacy landscape. Finally, we present good practices that help companies comply with GDPR requirements and earn the trust of their clients and users.
Fundamental principles of the GDPR
The GDPR rests on several fundamental principles that guide the processing of personal data. These principles are essential to ensure fair, transparent and secure processing of personal data:
Lawfulness, fairness and transparency: Organisations must process personal data lawfully, fairly and transparently in relation to the data subject. They must therefore inform individuals clearly about how they will use their data and ensure fair and lawful processing.
Purpose limitation: Organisations should only collect data for specified, explicit and legitimate purposes. Consequently, they cannot further process it in a manner incompatible with those purposes.
Data minimisation: Organisations should process only data that is adequate, relevant and necessary for the purposes of the processing.
Accuracy: Personal data must be accurate and, where necessary, kept up to date. To this end, organisations must take every reasonable step to erase or rectify inaccurate data.
Storage limitation: Organisations should keep data only for as long as the purposes of the processing require. After that period, the data should no longer allow data subjects to be identified.
Integrity and confidentiality: Organisations must process personal data with appropriate security. In particular, they must protect it against unauthorised or unlawful processing and against accidental loss, destruction or damage.
Data subject rights
The GDPR strengthens individuals’ rights over their personal data, giving them greater control and transparency. The article on data subject rights explains how people exercise them and how organisations should respond. In summary, the most significant are:
Right of access: Individuals have the right to know whether an organisation processes their personal data. If so, they can also access that data and the information related to the processing.
Right to rectification: Data subjects have the right to have inaccurate personal data about them rectified. In addition, they can have incomplete data completed.
Right to erasure (right to be forgotten): In certain circumstances, individuals have the right to have their personal data erased. This applies, for example, to data that is no longer necessary for the purposes for which it was collected.
Right to restriction of processing: Data subjects can request the restriction of processing of their personal data in certain situations. This happens, in particular, when they contest the accuracy of the data or when the processing is unlawful.
Right to object: Individuals have the right to object to the processing of their personal data under certain conditions, including for direct marketing purposes.
Right to data portability: Data subjects have the right to receive the personal data they have provided to an organisation in a structured, commonly used and machine-readable format. They also have the right to transmit that data to another organisation.
Right not to be subject to automated decisions: Individuals have the right not to be subject to decisions based solely on automated processing, including profiling. This applies to decisions that produce legal effects or similarly significantly affect them.
Obligations of organisations
In addition to respecting data subject rights, organisations have several obligations under the GDPR:
Appointing a data protection officer (DPO): In certain circumstances, organisations must appoint a DPO to monitor GDPR compliance.
Data protection impact assessments: These assessments are mandatory when processing is likely to result in a high risk to the rights and freedoms of individuals.
Data breach notification: Organisations must notify the competent data protection authority of personal data breaches without undue delay. In certain cases, they must also inform the data subjects of the breach.
Data security: Organisations must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
A fundamental right
First of all, personal data protection is not just a technical rule. In fact, it is a fundamental right, recognised in Article 8 of the Charter of Fundamental Rights of the European Union. In Portugal, Article 35 of the Constitution has also protected citizens with regard to the use of computing since 1976. The GDPR, in turn, gives effect to this right, and Law no. 58/2019 ensures its implementation in the national legal order.
This status as a fundamental right therefore has practical consequences. For example, any restriction must be provided for by law and be necessary and proportionate. In addition, courts and supervisory authorities interpret the rules in a way that ensures effective protection for individuals.
The role of the CNPD
The National Data Protection Commission (CNPD) is the supervisory authority in Portugal. Specifically, it receives complaints from data subjects and data breach notifications, issues guidance and can impose fines. Under the GDPR, fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher. On the other hand, the CNPD plays an important educational role through guidelines and answers to frequently asked questions.
Data protection in employment relationships
In the workplace, processing workers’ data follows specific rules. Article 28 of Law no. 58/2019 covers employment relationships and sets, among other things, limits on the use of biometric data and video surveillance systems. Likewise, the Labour Code protects the worker’s right to privacy. For this reason, organisations must take particular care when configuring document management platforms that handle workers’ documents.
Practical example: Request only what is necessary
Imagine a company that required a copy of the citizen card of every external worker. However, when reviewing the process, it realises that it only needs the name and an identification number for access control. In response, it stops collecting the copies and records only the necessary data. In this way, it reduces the risk in the event of a data breach and complies with the data minimisation principle.
Frequently asked questions
Who can lodge a complaint with the CNPD?
In principle, any data subject who considers that the processing of their data infringes the GDPR, without prejudice to also going to court.
Does the GDPR apply to small businesses?
Yes. Indeed, the GDPR applies to all organisations that process personal data, regardless of size. However, some obligations, such as the record of processing activities, have limited exceptions for small businesses.
Conclusion: The right to data protection
The General Data Protection Regulation (GDPR) is a significant milestone in personal data protection. Indeed, it reflects the growing need to safeguard individuals’ privacy in a constantly evolving digital context. Through a comprehensive set of rules and rights, the GDPR strengthens citizens’ control over their personal data. In return, it imposes strict obligations on organisations that handle such data.
Applying the GDPR has highlighted the importance of transparent and responsible practices in collecting, processing and retaining personal data. Rights such as access, rectification, erasure and portability give individuals control over their data. At the same time, consent, when it is the appropriate legal basis, must be freely given, specific, informed and unambiguous.
For organisations, GDPR compliance is not just a legal obligation, but also an opportunity to build trust and reputation in the market. Adopting robust security measures, clear privacy policies and effective data management processes is essential to meet the regulation’s requirements and to protect client data. In addition, GDPR compliance can be a source of competitive differentiation, because it positions the company as a responsible organisation committed to privacy.
Ultimately, the GDPR not only protects individual rights, such as the right to data protection, but also sets a global benchmark in this field. Technology continues to advance and threats to privacy are becoming more complex. Adherence to the GDPR principles will therefore be crucial to ensure security and trust in the digital environment.
For organisations that manage documentation for workers and contractors, this means building data protection into their processes and the platforms that support them, collecting only the information they need and keeping it secure.
Read also: GDPR: Impact on companies, challenges and opportunities and Adapting document management platforms to GDPR guidelines.
For official information on your rights, visit the National Data Protection Commission (CNPD).