Data subject rights under the GDPR : with a commentary through the lens of the data-driven economy

## Abstract In 2018, the GDPR started a revolution in the data protection world. One of the most far-reaching developments of the new regulation was the chapter on data subject rights. Old rights were strengthened and extended, and several new rights were introduced. For data subjects who felt overwhelmed with the information overload, the GDPR meant a promise of more individual control over data. In combination with severe financial penalties, the revised rights brought the potential to become a vehicle of data protection law enforcement. However, there are still many uncertainties related to data subject rights due to the fact that the GDPR only recently entered into force. The Court of Justice of the EU and other EU governmental authorities have not yet had the time to provide thorough and updated guidance (although the court has been actively adjudicating on these individual rights ever since the GDPR was adopted). Not only is the lack of guidance a problem, the applicability of data subject rights is strongly influenced by the economic and social (data-driven) context. This book provides a thorough analysis of data subject rights under the new GDPR framework and their legal operation. The goal is to help individuals (lawyers and others) to navigate the subject area and/or possibly pursue claims. Its additional value is that it considers the rights in a big data environment and therefore more accurately points out inefficiencies and provides criticism where needed. Having control over personal data is regarded as a fundamental right in the EU. Since the General Data Protection Regulation (GDPR) became enforceable May 2018, old rights were strengthened, and a range of new rights were introduced. How to navigate the changing landscape of data subject rights under the GDPR framework is the focal point of this volume. At the centre of this discussion are five key rights: the right to information, the right to access, the right to data portability, the right to be forgotten, and the rights related to profiling (the right to object and the right not to be subject to automated decision-making). With a focus on how these fit into big data economies, this book gives practitioners and activists the knowledge of how to pursue claims while also pointing out inefficiencies where data subject rights are concerned in a big data environment. As legal guidance slowly develops and still appears fragmented, this volume tackles the gaps and provides a thorough analysis of data subject rights under the new GDPR framework and their legal operation. Title_Pages 1 Dedication 5 Table_of_Cases 6 Table_of_Legislation 9 List_of_Abbreviations 11 Introduction 13 Safeguarding_Individuals_in_the_Datadriven_EconomyEU_Data_Protection_Framework_in_a_Nutshell 28 Control_as_a_Central_Notion_in_the_Discussion_on_Data_Subject_Rights 60 The_Right_to_Information 76 The_Right_of_Access_under_EU_Data_Protection_Law 116 The_Right_to_Be_Forgotten 141 Data_Portability_as_a_Data_Subject_Right 171 Data_Subject_Rights_in_Relation_to_Profiling 201 Conclusions_Striving_for_Data_Subject_Control_within_and_beyond_Data_Subject_Rights 227 Bibliography 249 Index 276 To navigate the changing landscape and be able to pursue claims, this book gives practitioners and activists a comprehensive overview of data subject rights. It also provides readers with the historical context and theoretical underpinnings that shaped the introduction of data subject rights.