GDPR Specialist Rights of Data Subjects 3 — Questions and Answers
Question 1: A data subject asks a controller to supply their personal data in a 'commonly used, machine-readable format' under Article 20 GDPR. Which scenario correctly applies this right?
- A patient requests paper copies of hospital records held for legal compliance purposes
- A user requests their social media profile data exported as a JSON or CSV file (Correct answer)
- An employee requests their HR file held under a collective agreement
- A customer requests erasure of their purchase history from an e-commerce site
Correct answer: A user requests their social media profile data exported as a JSON or CSV file
Article 20 portability applies to data provided by the subject to a controller under consent or contract, and the format must be machine-readable (e.g., JSON, CSV).
Question 2: Under GDPR, within what timeframe must a controller generally respond to a data subject's request, and what extension is permitted?
- 30 days; extendable by another 30 days for complex or numerous requests
- One month; extendable by a further two months for complex or numerous requests (Correct answer)
- 15 business days; extendable by 30 calendar days
- 72 hours; extendable by one week with supervisory authority approval
Correct answer: One month; extendable by a further two months for complex or numerous requests
Article 12(3) GDPR sets a one-month response period, extendable by two months where necessary, with the data subject informed of any extension within the first month.
Question 3: Which of the following rights is explicitly NOT available to data subjects when personal data is processed solely for archiving purposes in the public interest, scientific research, or statistical purposes under Article 89 GDPR?
- Right to information under Articles 13 and 14
- Right to erasure where it would render impossible or seriously impair the research objectives (Correct answer)
- Right to lodge a complaint with a supervisory authority
- Right to be informed of a personal data breach
Correct answer: Right to erasure where it would render impossible or seriously impair the research objectives
Article 17(3)(d) GDPR exempts controllers from erasure obligations when the data is needed for archiving, research, or statistical purposes under Article 89 safeguards.
Question 4: A controller charges a 'reasonable fee' for responding to a data subject access request. Under which condition does GDPR permit this?
- Whenever the request involves more than 50 records
- When the request is manifestly unfounded or excessive, particularly if repetitive (Correct answer)
- When the data subject has made any prior request in the same calendar year
- When the controller is a small business with fewer than 250 employees
Correct answer: When the request is manifestly unfounded or excessive, particularly if repetitive
Article 12(5) GDPR allows a reasonable fee or refusal only for requests that are manifestly unfounded or excessive, especially repetitive ones.
Question 5: When a controller restricts processing under Article 18 GDPR, what must it do before lifting the restriction?
- File a report with the supervisory authority
- Inform the data subject before lifting the restriction (Correct answer)
- Obtain fresh consent from the data subject
- Conduct a new DPIA to re-assess risks
Correct answer: Inform the data subject before lifting the restriction
Article 18(3) GDPR requires the controller to inform the data subject before lifting any restriction on processing.
Question 6: Under GDPR, which right gives a data subject the ability to not be subject to a decision based solely on automated processing that produces significant legal effects?
- Right to object (Article 21)
- Right not to be subject to automated individual decision-making (Article 22) (Correct answer)
- Right to erasure (Article 17)
- Right to restriction (Article 18)
Correct answer: Right not to be subject to automated individual decision-making (Article 22)
Article 22 GDPR specifically addresses automated individual decision-making, including profiling, that significantly affects the data subject.
Question 7: A data subject invokes the right to restriction because they contest the accuracy of their data. How long may the controller take to verify accuracy before the restriction must be lifted or maintained?
- Up to 72 hours from the restriction request
- For as long as it takes the controller to verify the accuracy of the data (Correct answer)
- No longer than one calendar month under any circumstance
- Until the supervisory authority issues a binding decision
Correct answer: For as long as it takes the controller to verify the accuracy of the data
Article 18(1)(a) GDPR allows restriction 'for a period enabling the controller to verify the accuracy' — there is no fixed time limit beyond what is reasonable.
GDPR Specialist Rights of Data Subjects 3
A data subject asks a controller to supply their personal data in a 'commonly used, machine-readable format' under Article 20 GDPR.
Which scenario correctly applies this right?