Data Subject Rights under the GDPR

279 Pages·2021·1.973 MB·English

by  Helena U. Vrabec

Data Subject Rights under the GDPR

Data Subject Rights
under the GDPR
With a Commentary through the Lens of the
Data- driven Economy
HELENA U. VRABEC
1
3
Great Clarendon Street, Oxford, OX2 6DP,
United Kingdom
Oxford University Press is a department of the University of Oxford.
It furthers the University’s objective of excellence in research, scholarship,
and education by publishing worldwide. Oxford is a registered trade mark of
Oxford University Press in the UK and in certain other countries
© Helena U. Vrabec 2021
The moral rights of the author have been asserted
First Edition published in 2021
Impression: 1
All rights reserved. No part of this publication may be reproduced, stored in
a retrieval system, or transmitted, in any form or by any means, without the
prior permission in writing of Oxford University Press, or as expressly permitted
by law, by licence or under terms agreed with the appropriate reprographics
rights organization. Enquiries concerning reproduction outside the scope of the
above should be sent to the Rights Department, Oxford University Press, at the
address above
You must not circulate this work in any other form
and you must impose this same condition on any acquirer
Crown copyright material is reproduced under Class Licence
Number C01P0000148 with the permission of OPSI
and the Queen’s Printer for Scotland
Published in the United States of America by Oxford University Press
198 Madison Avenue, New York, NY 10016, United States of America
British Library Cataloguing in Publication Data
Data available
Library of Congress Control Number: 2020951503
ISBN 978– 0– 19– 886842– 2
DOI: 10.1093/ oso/ 9780198868422.001.0001
Printed and bound by
CPI Group (UK) Ltd, Croydon, CR0 4YY
Links to third party websites are provided by Oxford in good faith and
for information only. Oxford disclaims any responsibility for the materials
contained in any third party website referenced in this work.
To my son Albert
Table of Cases
JUDGMENTS
Court of Justice of the EU
Case C- 201/ 14 Bara and Others [2015] ECLI:EU:C:2015:638 . . . . . . . . . . . . . .64, 67n.18, 95
Case C- 364/ 01 Barbier [2000] ECLI:EU:C:2003:665 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22n.46
Case C- 28/ 08 Bavarian Lager [2010] ECLI:EU:C:2010:378 . . . . . . . . . . . . . . . . . . . 53, 104n.1
Case C- 582/ 14 Breyer [2016] ECLI:EU:C:2016:779 . . . . . . . . . . . . . . . . . . 25n.60, 31, 34n.114
Case C- 398/ 15 Camera di Commercio, Industria, Artigianato e Agricoltura di
Lecce v Salvatore Manni [2017] ECLI:EU:C:2017:197 . . . . . . . . . . . . . . . . . . . . . .139– 41
Joined cases Case C-2 93/ 12 and C-5 94/ 12 Digital Rights Ireland and Others
[2014] EU:C:2014:238 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21n.33, 119– 20
Case C- 468/ 10 ASNEF [2011] ECLI:EU:C:2011:777 . . . . . . . . . . . . . . . . . . . . . . . . . 22n.44, 23
Case C- 40/ 17 Fashion ID [2019] ECLI:EU:C:2019:629 . . . . . . . . . . . . . . . . . . . . . . . . . . .32– 33
Case C- 6/ 64 Flaminio Costa v E.N.E.L. [1964] ECLI:EU:C:1964:66 . . . . . . . . . . . . . . . 12n.69
Case C- 136/ 17 GC and Others v Commission nationale de l’informatique et
des libertés [2019] ECLI:EU:C:2019:773 . . . . . . . . . . . . . . . . . . . . . . . . . . . .139, 154n.141
Case C- 507/ 17 Google v Commission nationale de l’informatique et des
libertés [2019] EU:C:2019:772 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
Case C- 131/ 12 Google Spain [2014] ECLI:EU:C:2014:317 . . . . . . . . . . . . . . . . 18– 19, 25n.61,
116– 17, 125n.109, 132–3 3, 134– 39, 142, 146, 149, 156–5 7
Case C- 473/ 12 IPI v Geoffrey Engelbert [2013] ECLI:EU:C:2013:715 . . . . . .92n.154, 95– 96
Case C- 555/ 07 Kücükdeveci [2010] ECLI:EU:C:2010:21 . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Case C- 101/ 01 Lindqvist [2003] ECLI:EU:C:2003:596 . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Joined cases C-4 65/ 00, C- 138/ 01 and C-1 39/ 01 Österreichischer Rundfunk
and Others [2003] EU:C:2003:294 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Case C- 673/ 17 Planet49 GmbH [2019] ECLI:EU:C:2019:801 . . . . . . . . . . . . . . . . . . . . . . .100
Case C- 275/ 06 Promusicae [2008] ECLI:EU:C:2008:54 . . . . . . . . . . . . . . . . . . . . . . . . . 25n.59
Case C-13/ 16 Rigas [2017] ECLI:EU:C:2017:336 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68n.19
Case C- 553/ 07 Rijkeboer [2009] ECLI:EU:C:2009:293 . . . . . . . . . . . . . . . . . . . . . . . . .104, 117
Case C- 36/ 75 Roland Rutili v Minister for the Interior [1975]
ECLI:EU:C:1975:137 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17n.7
Case C- 73/ 07 Satakunnan Markkinapörssi and Satamedia [2008]
ECLI:EU:C:2008:727 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Case C- 70/ 10 Scarlet v Sabam [2016] ECLI:EU:C:2011:771 . . . . . . . . . . . . . . . . . . . . . . 31n.94
Case C- 362/ 14 Schrems [2015] ECLI:EU:C:2015:650 . . . . . . . . . . . . . . . . . . . . . . . . . .119n.77
Case C 203/1 5 and C 698/1 5 Tele2 Sverige and Watson and Others [2016]
ECLI:EU:C:2016:970 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119n.77
Joined cases C-9 2/ 09 and C-9 3/ 09 Volker und Markus Schecke GbR,
Hartmut Eifert v Land Hessen [2010] ECLI:EU:C:2010:662 . . . . . . . . . .22n.44, 23n.51,
94n.162
Case C- 230/ 14 Weltimmo [2015] ECLI:EU:C:2015:426 . . . . . . . . . . . . . . . . . . . . . . . . . 58n.68
Case C- 210/ 16 Wirtschaftsakademie Schleswig-H olstein [2018]
ECLI:EU:C:2018:57 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58n.68
Opinion 1/ 15 of the Court regarding Draft agreement between Canada and the
European Union on the transfer and processing of Passenger Name Record
data [2017] ECLI:EU:C:2017:592 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72n.42
xiv Table of Cases
Case T- 194/ 04 Bavarian Lager v Commission [2007] ECLI:EU:C:2010:378
(General Court) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26n.67
Commission Decisions
Google/ Double Click (Case COMP/M .4731) Commission Decision 927
[2008] OJ C184/1 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43– 44
TomTom/ TeleAtlas (Case COMP/M .4854) Commission Decision 1859
[2008] OJ C237/8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43– 44
European Court of Human Rights
Barbulescu v Romania App no 61496/0 8 (ECtHR, 12 January 2016) . . . . . . . . . . . . . . 20n.31
Benedik v Slovenia App no 62357/1 4 (ECtHR, 24 April 2018) . . . . . . . . . . . . . . . . . . . . 30n.89
Koch v Germany App no 497/0 9 (ECtHR, 19 July 2012) . . . . . . . . . . . . . . . . . . . . . . .184n.156
Magyar Helsinki Bizottsag v Hungary App no 18030/1 1
(ECtHR, 8 November 2016) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21– 22, 26– 27
Mitev v Bulgaria App no 42758/0 7 (ECtHR, 29 June 2010) . . . . . . . . . . . . . . . . . . . . .184n.156
MP and Others v Bulgaria App no 22457/0 8 (ECtHR, 26 July 2011) . . . . . . . . . . . . .184n.156
P and S v Poland App no 57375/0 8 (ECtHR, 30 October 2012) . . . . . . . . . . . . . . . . . . . 21n.38
Pretty v United Kingdom App no 2346/0 2 (ECtHR, 29 April 2002) . . . . . . . . . . . . . . . 20n.29
S and Marper v United Kingdom App nos 30562/0 4 and 30562/0 4
(ECtHR, 4 December 2008) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18n.12
Sanles v Spain App no 48335/9 9 (ECtHR, 26 October 2000) . . . . . . . . . . . . . . . . . . .184n.156
Surikov v Ukraine App no 42788/0 6 (ECtHR, 26 January 2017) . . . . . . . . . . . . . . . . . . 18n.16
Thévenon v France App no 2476/0 2 (ECtHR, 28 February 2006) . . . . . . . . . . . . . . .184n.156
National courts
United States
Roe v Wade 410 US 113 (1973) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20n.28
United States v Jones 564 US 400 (2012) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26– 27
The Netherlands
Judgment of the Dutch Supreme Court, 8 September 2017,
ECLI:NL:PHR:2017:933 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150n.120
Judgment of the Amsterdam District Court, 19 July 2018,
ECLI:NL:RBAMS:2018:8606 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137n.53
Judgment of the Hague District Court, 11 February 2020,
ECLI:NL:RBDHA:2020:1013 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .206– 7
The Decision of the Dutch Supreme Court, 24 February 2017,
ECLI:NL:HR:2017:288 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195n.29
The Decision of the Amsterdam District Court, 25 September 2019,
ECLI:NL:RBAMS:2019:8329 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203– 4
Belgium
Willem Debeuckelaere v Facebook Ireland Ltd., Facebook Inc. and
Facebook Belgium Bvba., Dutch- language Brussels Court of
First Instance, judgment of 16 February 2018 . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223n.53
Table of Cases xv
The United Kingdom
Damer & Ors v Taylor Wessing LLP [2017] EWCA Civ 74 . . . . . . . . . . . . . . . . . . . . . . . . . .114
Dawson- Damer & Ors v Taylor Wessing LLP [2019] EWHC 1258 (Ch) . . . . . . . . . . .114, 115
Open Rights Group & Anor, R (On the Application of) v Secretary of State
for the Home Department & Anor [2019] EWHC 2562 (Admin) . . . . . . . . . . . .119n.76
Germany
Bundesverfassungsgericht, judgment of 15 December 1983,
BverfGE 65, 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25– 26, 50– 51
Cologne Higher State Court, judgment of 14 November 2019,
ECLI:DE:OLGK:2019:1114.15U126.19.00 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .204
Table of Legislation
LAWS Directive 96/9 / EC of the
European Parliament and
European instruments of the Council of 11 March
Charter of Fundamental Rights of 1996 on the legal protection
the European Union [2010] of databases [1996]
OJ C83/ 389 . . . . .16– 17, 18– 19, 21, 22, OJ L77/ 20. . . . . . . . . . . . . . . . . . . 55n.52
23– 27, 28, 50, 51–5 2, 53, 96, 113, Directive 2002/5 8/ EC of the European
116– 17, 136– 37, 140, 170– 71 Parliament and of the Council
Commission Regulation (EU) No of 12 July 2002 concerning the
330/ 2010 of 20 April 2010 on the processing of personal data and
application of Article 101(3) of the protection of privacy in the
the Treaty on the Functioning of electronic communications sector
the European Union to categories [2002] OJ L201 . . . . . . . .38– 40, 96– 98,
of vertical agreements and 100– 1, 204
concerted practices [2010] Directive 2005/2 9/ EC of the
OJ L102 . . . . . . . . . . . . . . . .42– 43n.159 European Parliament
Convention for the Protection of and of the Council of 11 May
Individuals with regard to 2005 concerning unfair
Automatic Processing of Personal business- to- consumer
Data (Convention 108) (open commercial practices in the
for signature on 28 January 1981, internal market and amending
entered into force on 1 October Council Directive 84/ 450/ EEC,
1985) . . . . . . . . . . . . . . . . . . . . . . . . . .21 Directives 97/ 7/ EC, 98/ 27/ EC
Convention for the Protection of and 2002/ 65/ EC of the European
Human Rights and Fundamental Parliament and of the Council
Freedoms . . . . . . . . . . . . . . . . . . . 11n.67 and Regulation (EC) No 2006/
Council Directive 93/1 3/E EC of 5 April 2004 of the European
1993 on unfair terms in consumer Parliament and of the Council
contracts [1993] OJ L95 . . . . . . . . . . . 232 [2005] L149/ 22 . . . . . . . . . . .45, 232– 33
Council Regulation No 139/2 004 Directive 2011/8 3/ EU of the
of 20 January 2004 on the European Parliament and
control of concentrations of the Council of 25 October
between undertakings 2011 on Consumer Rights,
[2004] OJ L24 . . . . . . . . . . .42– 43n.159 amending Council Directive
Directive 95/4 6/ EC of the European 93/ 13/ EEC and Directive
Parliament and of the Council 1999/ 44/ EC of the European
of 24 October 1995 [1995] Parliament and of the Council
L281/ 31 . . . . . 9– 10, 64, 68, 69, 71n.39, and Repealing Council Directive
73, 76, 80, 83–8 4, 84n.111, 95–9 6, 85/ 577/ EEC and Directive
100, 61, 105, 107, 113, 97/ 7/ EC of the European
123– 24, 132– 34, 136, 148, Parliament and of the
149, 205– 6, 208, 213–1 4 Council [2011] L304/6 4 . . . .45, 46, 233
xviii Table of Legislation
Directive 2013/3 7/ EU of the European Regulation (EU) 2018/1 807 of the
Parliament and of the Council of European Parliament and of
26 June 2013 amending Directive the Council of 14 November 2018
2003/ 98/ EC on the re-u se of on a framework for the free
public sector information (PSI flow of non-p ersonal data in
Directive) [2013] OJ L175 . . . . . . . .164 the European Union [2018]
Directive 2015/2 366/ EU of the OJ L303 . . . . . . . . . . . . . . . . . . . .177– 78
European Parliament and of the Treaty of Lisbon amending the Treaty
Council of 25 November 2015 on on European Union and the
payment services in the internal Treaty establishing the European
market, amending Directives Community [2007] OJ C306/1 . . . . .22
2002/ 65/ EC, 2009/ 110/ EC and Treaty on European Union
2013/ 36/ EU and Regulation (EU) [1992] OJ C191 . . . . . . . . . . . . . . 29n.83
No 1093/ 2010, and repealing
Directive 2007/6 4/ EC [2015] OJ Germany
L337/ 35 . . . . . . . . . . . . . . . . . . . . . . .178
Federal Data Protection Act of 30 June
Directive 2016/1 148 of the
2017 (Federal Law Gazette I, 2097),
European Parliament and of
as last amended by Article 12 of the
the Council of 6 July 2016
Act of 20 November 2019 (Federal
concerning measures for a
Law Gazette I, 1626) . . . . . . . . . . . 120n.80
high common level of security
of network and information
Slovenia
systems across the Union
[2016] OJ L194/1 . . . . . . . . . . . . .41– 42 Criminal Code, Official gazette of the
Directive (EU) 2019/7 70 of the Republic of Slovenia No 91/2 0 . . . 132n.19
European Parliament and of Data Protection Act, Official
the Council of 20 May 2019 gazette of the Republic of
on certain aspects concerning Slovenia No 86/0 4 with further
contracts for the supply of digital amendments . . . . . . . . . . .132, 136n.43
content and digital services
[2019] OJ L136/1 . . . . . . . . . . . .46, 233 United Kingdom
Regulation (EU) 2016/6 79 of Data Protection Act 2018 . . . . . . . . .115, 119
the European Parliament and
of the Council of 27 April 2016 on
United States
the protection of natural persons
with regard to the processing California Assembly Bill
of personal data and on the free No 375 . . . . . . . . . . . . . . 187– 88
movement of such data, and
repealing Directive International instruments
95/ 46/ EC (General Data Vienna Declaration and Programme
Protection Regulation) [2016] of Action Adopted by the World
OJ L119/ 1. . . . . . . .9– 10, 29– 38, 42, 48, Conference on Human Rights in
59– 62, 64, 66–9 6, 105, 106–8 , 109, Vienna on 25 June 1993 . . . .17– 18n.11
111– 12, 113– 15, 121– 22, 130, 133, Council of Europe, Protocol 1 to the
141– 50, 159– 60, 163– 71, 174, 176, Convention for the Protection of
179– 80, 197– 212, 213– 14, Human Rights and Fundamental
220, 225, 230–3 5 Freedoms . . . . . . . . . . . . . . . . . . . . . . .54