Legal Justification Mapped to Rights

Owned by Mark Lizar
Last updated: Oct 15, 2024 by Salvatore D'Agostino
2 min read

Rights

These are the rights provide for in the GDPR and in the Convention 108+.

Subject Access

  1. Rectification

  2. Erasure

  3. Restrict Processing

  4. Object

  5. Automated Individual Decision Making: Processing and Profiling

 

  • Recital 67 and 68 - GDPR

    • In automated filing systems, the restriction of processing should in principle be ensured by technical means in such a manner that the personal data are not subject to further processing operations and cannot be changed. The fact that the processing of personal data is restricted should be clearly indicated in the system.

GDPR Legal Justification

Definition

Privacy Rights (7)

Liability/Obligation

Controller / Provider liability in the chain for personal data

References

GDPR Legal Justification

Definition

Privacy Rights (7)

Liability/Obligation

Controller / Provider liability in the chain for personal data

References

Consent

informed and meaningful consent is explicitly specified to a purpose of use, in such a way that it is clear data will be processed only in the manner specified

Subject Access, Rectification, Erasure, Restrict Processing, Object, Automated Individual Decision Making (6)

 

 

Public Interest, Public Org Surveillance

ask carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) and Recital 45

Subject Access, Rectification, Restrict Processing, Object, Automated Individual Decision Making (5)

 

 

Contractual Necessity

 personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Subject Access, Rectification, Restrict Processing (3)

Note; must by binding on processors to be valid.

 

 

Legal Obligation

processing is necessary for compliance with a legal obligation to which the controller is subject.

Subject Access, Rectification, Restrict Processing (3)

 

 

Legitimate Interest

  1. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Subject Access, Rectification, Erasure, Restrict Processing, Object, Automated Individual Decision Making (6)

 

 

Best/Vital Interest of Data Subject,

When consent is not required is when it is legally deemed in the best interest of the data subject to disclose and process personal information. Vital interests are intended to cover only interests that are essential for someone's life. 

Subject Access, Rectification, Restrict Processing, Automated Individual Decision Making(4)

 

 

NA

when legal justification is not provided. Is consent by default?

N/A - To provide legal notice - which includes what notice Fake Notice Should Be Reported by Investigator

OPN-MDC-Receipt transfers liability.
3 liability to Risk Category

  • civil

    • contract / industry framework / person

  • privacy

    • person / privacy / government

  • technology

    • certification / insurance

 

Â