SkarpChapter 3 of 16
Sensitive Data, Transparency, and the Architecture of Individual Rights
The GDPR intensifies protection when processing exposes highly sensitive aspects of a person while also demanding information that ordinary people can actually use. Its recitals map the full sequence of individual rights, from access and correction to objection, portability, erasure, and protection against automated decisions.
1. Why Some Personal Data Receive Higher Protection
The basic rationale
Recital (51) says: "Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection" because their processing context can create significant risks.
Photographs are conditional
A photograph is not automatically special-category data. It is biometric data only when a specific technical means allows unique identification or authentication of a natural person.
Protection is layered
Specific exceptions may permit processing, but Recital (51) says the GDPR's general principles and other rules should still apply, especially lawful-processing conditions.
2. Public Interest, Health, and National Conditions
Law plus safeguards
Recital (52) describes derogations provided by Union or Member State law, subject to suitable safeguards protecting personal data and other fundamental rights.
Health-related necessity
Recital (53) says higher-protection data should be processed for health-related purposes only where necessary to achieve those purposes for people and society as a whole.
Member State flexibility
Member States should be allowed to add conditions or limitations for genetic, biometric, or health data, but these should not hamper free movement in cross-border processing.
3. Applying the Health and Public-Interest Boundaries
Scenario: disease monitoring
A health authority may need health data for public-health monitoring and alerts without consent, but Recital (54) says suitable and specific protective measures should apply.
Purpose boundary
"Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties such as employers or insurance and banking companies."
Reasoning tool
Test a proposed use by separating the public-interest purpose, the safeguards for people, and any later third-party purpose that differs from the original public-health objective.
4. Identification and Transparency That People Can Use
No compelled identification
If the controller cannot identify a person from processed data, Recital (57) says it should not have to obtain extra information solely to comply with the GDPR.
But do not block rights
The controller should not refuse extra information supplied by the data subject to support exercise of rights. Online credentials can be part of digital identification.
Usable transparency
Recital (58) says information should be concise, accessible, understandable, and in clear, plain language; visualisation may be appropriate, especially in complex online ecosystems.
5. Information, Requests, and Timing
Mechanisms and deadline
Recital (59) contemplates free-of-charge mechanisms for key rights and electronic requests. It says controllers should respond without undue delay and at the latest within one month.
What people should be told
Recital (60) covers the existence and purposes of processing, necessary further information, profiling and consequences, and whether data provision is obligatory when data come from the person.
Source and exceptions
Recitals (61)-(62) distinguish direct and indirect collection, later-purpose processing, and cases where information need not be imposed because it is already known, legally prescribed, impossible, or disproportionate.
6. Access: Seeing Processing and Testing Its Lawfulness
Purpose of access
Recital (63) frames access as a way to become aware of processing and verify its lawfulness. It should be easy to exercise and available at reasonable intervals.
What access can reveal
The recital includes purposes, possible retention period, recipients, automatic-processing logic, and profiling consequences. Health-record examples include diagnoses and treatment information.
Limits without total refusal
Others' rights, trade secrets, intellectual property, and software copyright matter, but Recital (63) says they should not lead to refusing all information. Identity checks should use reasonable measures.
7. Correction, Erasure, Restriction, and Portability
Choose the remedy
Rectification addresses inaccurate data. Erasure concerns unlawful retention or listed circumstances. Restriction temporarily constrains processing. Portability concerns transferable data supplied by the person.
Erasure has limits
Recital (65) recognizes erasure grounds but also says continued retention should be lawful where necessary for specified interests such as expression, legal obligations, public health, research, and legal claims.
Portability conditions
Recital (68) links portability to automated processing and data supplied by the person under consent or contract, using "a structured, commonly used, machine-readable and interoperable format".
8. Objection, Automated Decisions, and Limits on Rights
Objection
Recital (69) contemplates objection based on a person's particular situation even where certain processing is lawful. For direct marketing, Recital (70) says objection should be available at any time and free of charge.
Solely automated decisions
Recital (71) covers decisions based solely on automated processing that produce legal effects or similarly significant effects, including examples of automated credit refusal and e-recruiting.
Safeguards and current status
Recital (71) describes information, human intervention, viewpoint, explanation, and challenge safeguards. The Digital Omnibus proposal has not entered into force; the GDPR wording taught here remains current.
9. Rights-Architecture Mapping Exercise
Map the request to the right
A music-streaming service uses automated recommendations, sends promotional emails, stores an old profile photo, and has a downloadable account-history file. A user makes four requests:
- "Show me the data you hold and explain who receives it."
- "Stop using my account for promotional emails."
- "Correct my wrong birth year and remove my old public profile."
- "Give me the listening history I supplied in a format another service can use."
Pause before reading on. Match each request to the relevant recital sequence:
- Access: Recital (63), including purposes, recipients, and certain automated-processing information.
- Direct-marketing objection: Recital (70), including related profiling, at any time and free of charge.
- Rectification and erasure: Recital (65), while considering whether a listed basis makes further retention lawful.
- Portability: Recital (68), only if its conditions are met: automated processing, data provided by the person, and consent or contract as the basis described in the recital.
Now test your reasoning. The user cannot demand portability merely because data exist. Conversely, a controller cannot treat a large volume of information as a reason to deny access altogether; Recital (63) says it should be able to ask the person to specify relevant information or processing activities. For every request, also apply Recital (59): the request mechanism should facilitate exercise of rights, including electronically where appropriate, and the recital describes a response without undue delay and at the latest within one month.
10. Quiz: Sensitive Data and Transparency
Choose the best answer based on Recitals (51), (57), and (58) of the GDPR.
Which statement best reflects the recitals' treatment of a photograph and identification?
- Every photograph is automatically special-category personal data, so the controller must always collect extra identity information before responding to a rights request.
- A photograph is biometric data only when processed through a specific technical means allowing unique identification or authentication; a controller that cannot identify a person should not be obliged to obtain extra information solely to comply with the GDPR.
- Photographs can never be personal data, and controllers should refuse any additional information offered by a person making a request.
- A controller may provide information only in technical legal language because visualisation is never appropriate.
Show Answer
Answer: B) A photograph is biometric data only when processed through a specific technical means allowing unique identification or authentication; a controller that cannot identify a person should not be obliged to obtain extra information solely to comply with the GDPR.
Recital (51) says photographs should not systematically be considered special-category data and identifies the condition for biometric-data treatment. Recital (57) says the controller should not be obliged to acquire additional information solely to identify the person for GDPR compliance, while it should not refuse additional information supplied to support rights.
11. Quiz: Automated Decisions and Portability
Choose the answer that preserves the conditions and safeguards described in Recitals (68) and (71).
A company automatically rejects a person's online credit application with no human involvement. Which answer is most accurate under the recitals?
- The decision is always allowed because a credit application concerns a contract.
- The person should have the right not to be subject to a solely automated decision producing legal or similarly significant effects; where such processing is allowed under the described conditions, safeguards should include information, human intervention, a viewpoint, explanation, and challenge.
- The person can only use portability, which automatically erases all account data.
- The controller may deny any explanation whenever its system uses mathematical procedures.
Show Answer
Answer: B) The person should have the right not to be subject to a solely automated decision producing legal or similarly significant effects; where such processing is allowed under the described conditions, safeguards should include information, human intervention, a viewpoint, explanation, and challenge.
Recital (71) expressly uses automatic refusal of an online credit application as an example. It describes circumstances in which automated decision-making should be allowed and says suitable safeguards should include specific information, human intervention, the ability to express a viewpoint, an explanation after assessment, and the ability to challenge the decision. Portability in Recital (68) is a distinct right with separate conditions and does not itself imply erasure.
12. Flashcards: Core Rights Vocabulary
Flip each card, then explain the condition or limit aloud before moving to the next one.
- Special categories and photographs
- Recital (51) says sensitive data merit specific protection. Photographs should not systematically be special-category data; they are biometric data only when processed through specific technical means allowing unique identification or authentication.
- No compelled identification
- Where processed data do not permit identification, the controller should not be obliged to acquire additional information solely to identify the person for GDPR compliance. It should not refuse additional information supplied to support rights.
- Transparency
- Information should be concise, easily accessible, easy to understand, and use clear and plain language; visualisation may be appropriate. Child-directed information should be understandable to a child.
- Request response
- Recital (59) says the controller should respond without undue delay and at the latest within one month, and give reasons when it does not intend to comply.
- Access
- Access enables a person to know about collected data and verify lawfulness. It includes, in particular, purposes, possible retention period, recipients, automatic-processing logic, and certain profiling consequences.
- Erasure and restriction
- Erasure may apply in Recital (65)'s listed circumstances but has listed lawful-retention limits. Restriction may involve making data unavailable or technically preventing further processing and change.
- Portability
- For automated processing, Recital (68) describes data provided by the person under consent or contract, received in a structured, commonly used, machine-readable and interoperable format.
- Automated decision
- Recital (71) covers solely automated decisions producing legal or similarly significant effects. Described safeguards include information, human intervention, viewpoint, explanation, and challenge.
Key Terms
- profiling
- Automated processing evaluating personal aspects relating to a natural person, including stated examples such as performance at work, economic situation, health, preferences, behaviour, location, or movements.
- controller
- The actor referred to throughout these recitals as processing personal data and facilitating, responding to, or assessing data-subject requests.
- data subject
- The natural person to whom personal data relate and whose rights are discussed in Recitals (57)-(73).
- transparency
- The principle in Recital (58) requiring information to be concise, accessible, understandable, and expressed in clear and plain language, with visualisation where appropriate.
- biometric data
- In Recital (51)'s photograph example, data covered only when processed through a specific technical means allowing unique identification or authentication of a natural person.
- data portability
- The Recital (68) ability to receive certain data supplied by the person, where stated conditions apply, in a structured, commonly used, machine-readable and interoperable format and transmit them to another controller.
- direct marketing
- Processing for which Recital (70) says the data subject should be able to object at any time and free of charge, including related profiling.
- restriction of processing
- A constraint described in Recital (67), such as moving data temporarily, making them unavailable, or technically preventing further processing and changes.
- solely automated decision
- A decision based solely on automated processing that produces legal effects or similarly significantly affects the person, as described in Recital (71).
- special categories of personal data
- The higher-protection category discussed in Recitals (51)-(54), including data such as those revealing racial or ethnic origin and, under stated conditions, biometric data.