ch14

Right to Erasure and Restriction of Processing

• The controller does not need personal data, but the data subject requires it for the establishment, exercise, or defense of legal claims.
• The controller is verifying whether its legitimate grounds override those of the data subject.
• The GDPR requires controllers to communicate any rectification or erasure of personal data and any restriction of processing to each recipient to whom they have disclosed the personal data.

Right to Data Portability

• The GDPR strengthens data subjects' control and access to their personal data with the right to data portability.
• Data subjects can port data to themselves or to another controller.
• Data subjects may request that the data is provided in a structured, commonly used, and machine-readable format such as CSV or Excel files.

Transfers of Personal Data

• The GDPR governs cross-border transfers of personal data from the EU and Norway, Liechtenstein, and Iceland (EEA) to non-EEA countries or international organizations.
• Transfers are prohibited unless one of the following transfer mechanisms can be relied upon: an adequacy decision, an appropriate safeguard, or a derogation.
• An adequacy decision is needed for transfers to adequate countries.
• Appropriate safeguards and derogations are used for transfers to other "third countries" outside the EEA.

Derogations

• Derogations allow for a transfer if the data subject has provided explicit consent to the transfer or if the transfer is necessary for one of the following:
  • The performance of a contract between the data subject and controller.
  • The performance or conclusion of a contract concluded in the interest of the data subject between the controller and a third party.
  • Important reasons of public interest.
  • The establishment, exercise, or defense of legal claims.
  • The protection of the vital interests of an individual incapable of giving consent.
• A transfer is also allowed if made from a public register.
• As a last-resort derogation, a transfer may take place if none of the other derogations apply if it is necessary for the purposes of compelling legitimate interests.

Fines and Criminal Sanctions

• The maximum fines can be the greater of €10 million or 2 percent of global annual revenues.
• Member states are permitted to impose criminal sanctions for violation of the GDPR.
• At least 10 countries have adopted criminal sanctions.

EU Requirements for International Data Transfers

• The GDPR governs cross-border transfers of personal data.
• Transfers of personal data from the EU and Norway, Liechtenstein, and Iceland (EEA) to non-EEA countries or international organizations are prohibited unless one of the following transfer mechanisms can be relied upon: an adequacy decision, an appropriate safeguard, or a derogation.
• The EDPB and other EU regulators have interpreted the scope of these derogations relatively narrowly, citing case law permitting derogations only so far as is "strictly necessary".