The EU’s General Data Protection Regulation (GDPR) underpins the UK’s data protection regime. Under the GDPR, any organisation that handles personal information must use robust measures to keep this data safe. The more you know about the GDPR, the easier it is to hold organisations to account when they fail to protect your data rights.
The GDPR is an EU law on data protection and privacy. It establishes how your personal information can be used by organisations, businesses and the government.
Despite Brexit, all UK organisations must comply with the GDPR as the UK chose to implement its version of the law after the transition period ended (UK GDPR). In the UK, the Data Protection Act (DPA) 2018 is the UK’s interpretation of the GDPR.
Under GDPR, people have a right to be notified if their personal data is being used or stored. This includes why an organisation uses your data, how it is using it, what type/types of data it is using, how long the data will be kept, if it shares this data with any third parties, and more. A failure to provide this information could be a data protection breach.
Personal data includes can be used to identify a specific individual – either on its own or along with other information. This could be a name, email address, financial information or even an IP address.
You have the legal right to access any personal data an organisation holds on you. To exercise this right, you should ask for a copy of this data.
You can challenge the accuracy of any personal data that an organisation holds about you and ask for it to be corrected or added to. Organisations do not always have to agree to such requests (for example, a doctor does not have to change an individuals’ medical history if they believe a request is erroneous). But they must provide a legitimate reason if they do not so (and tell the data subject what that reason is).
GDPR gives you the right to have your personal data erased. This is also known as ‘the right to be forgotten’. The right is not absolute and only applies in certain circumstances.
You can restrict the way an organisation uses your personal data. This means you can limit the way that an organisation uses your data. This is an alternative to requesting the complete erasure of your data.
You have the right to get a copy of your personal data from an organisation. You might want this data to pass to another organisation, so it must be provided in a transferable way if possible.
In some circumstances, you can object to an organisation using your data at all. For example, you have the right to stop an organisation from using your data for email marketing.
Under GDPR, the processing of biometric data (such as images of a person’s face) and the use of automated decision-making, including profiling, are only allowed in very explicit circumstances. If an organisation uses technology that discriminates against individuals and automatically makes decisions that harm them, such technology would not be GDPR compliant.
To access many of your GDPR data rights, you need to make a data subject access request (DSAR/SAR). You do not have to pay to make a DSAR. However, if you ask for extra copies, or if you ask for something that is ‘manifestly unfounded or excessive’, the organisation might charge a reasonable fee for administrative costs.
Data protection law requires organisations to respond to a request for data within one calendar month. However, they might need extra time to consider your request and, if so, can take an additional two months to do this. The organisation must let you know within one month if it needs more time and why. If the requested information is not provided in the timeframe, you can raise a complaint with the ICO. A refusal to answer respond to such a request within the legal timeframe could be a GDPR breach.
You can make a subject access request at any time. For example, many of our clients at KP Law make DSARs to start the compensation claim process following a data breach. If you decide that you want to make a SAR, there are some steps you should take…
An organisation can refuse a request if they believe it to be ‘manifestly unfounded or excessive’. But, if you think your request has been rejected unjustly, you can raise a complaint with the organisation in question, and if you remain dissatisfied, the ICO.
When it comes to GDPR failures and abuses, most people think about data breaches.
A data breach refers to any situation where data has been put at risk. For example, when criminals break into an organisation’s systems to steal information, or more commonly, because of simple human error and poor data protection processes.
But GDPR violations are not just about data breaches. A GDPR failure can happen when companies fail to uphold any of your individual data rights.
At KP Law, our data protection team is committed to making sure that people across England & Wales understand their data protection rights. And, if your rights have been violated by an organisation breaching any part of the GDPR/Data Protection Act, we may be able to help you to claim compensation. For example, in addition to our various data breach group actions, we support clients who have experienced GDPR violations because of facial recognition software and algorithmic and automated decision-making processes.
KP Law is a formidable multi-claimant law firm. Combining technical expertise with experience in handling large-volume cases, we represent our clients with passion, experience and diligence.
Having opened a new data breach division in 2020, our solicitors have gained an enviable reputation in data breach law. And, with a team of data protection experts led by Kingsley Hayes – arguably the UK’s foremost data breach solicitor – and considerable multi-claimant expertise, it’s easy to see why.
We have offices in London, Birmingham and Liverpool, and the technology to provide a nationwide service.
Other firms might claim to be data protection experts, but it takes more than an understanding of the law to succeed. At KP Law, our team of data breach lawyers has the passion, skill, persistence and resources to fight your corner and win.
