GDPR
General Data Protection Regulation (EU Regulation 2016/679) is the primary legal framework governing data protection and privacy in the European Union and the European Economic Area. It establishes the rights of individuals regarding their personal data and imposes obligations on organizations that process such data.
Key Principles
- Lawfulness, fairness, and transparency: Processing must have a legal basis and be clear to the data subject.
- Purpose limitation: Data collected for specified purposes cannot be used for incompatible purposes.
- Data minimization: Only data adequate, relevant, and limited to what is necessary should be processed.
- Accuracy: Personal data must be accurate and kept up to date.
- Storage limitation: Data should not be kept longer than necessary for the purposes for which it is processed.
- Integrity and confidentiality: Security measures must protect against unauthorized processing or accidental loss.
- Accountability: The controller is responsible for demonstrating compliance with the above principles.
Individual Rights
- Right to access: Obtain confirmation of processing and a copy of the data.
- Right to rectification: Correct inaccurate or incomplete data.
- Right to erasure (“Right to be forgotten”): Request deletion of personal data under specific circumstances.
- Right to restriction of processing: Limit how data is used while accuracy is verified or legal claims are established.
- Right to data portability: Receive data in a structured, machine-readable format and transfer it to another controller.
- Right to object: Object to processing based on legitimate interests or direct marketing.
- Rights related to automated decision-making: Including profiling.
Enforcement and Penalties
- Supervised by Data Protection Authorities (DPAs) in each member state.
- Fines can reach up to €20 million or 4% of global annual turnover, whichever is higher.
- Requires Data Protection Impact Assessment (DPIA) for high-risk processing activities.
Related Tools and Automation
To exercise the right to erasure effectively, individuals often face challenges due to the sheer volume of data brokers.
- Unbroker: An automation tool designed to streamline the process of deleting personal data from data broker databases.
- Developed as a skill for the open-source hermes-agent.
- Targets the removal of data from 500+ data brokers locally.
- Addresses the gap between legal rights (GDPR/CCPA) and the practical difficulty of exercising them.
- See Unbroker: Automating Personal Data Deletion from Data Brokers Locally for detailed implementation notes.