Lecture 6 - The right of data subjects (chapter 5)
The data subject rights are not often used, as they are for example unknown. We should be
on the shoulders of our bureaucrats and these data rights are a perfect means to bully them.
Right to access
Right to access is a fundamental right to have data access as a data subject. When we lift
the discussion up to a fundamental rights one, the constitution gets bigger and then the
discussion becomes symbolic. Article 8 of Convention 108 and article 12 of the Data
protection Directive. Exceptions can be overriding legal interests, public interests that are
more compelling than private interests, for example journalism. If a journalist is collecting
data on you, he could invoke a compelling interest in order not to give you the data until his
article has been published. You can see that the legal provisions are a way of applying the
human rights principles. Another exception is article 9 Convention and 13 Directive for the
purpose of scientific research. However, there is a proportionality reasoning in this exception
that has to do with the cost. At page 109 there is the right to rectification and the right to
object on page 112. The right to access has been acknowledged by the court in the Leander
case, the court said that it follows from article 8 that you have an access right. So from the
right to privacy, the right to access follows. This is creating new rights, right to privacy is a
trigger for new rights. Everyone in paragraph 2 has the right to access.
The Directive is the most explicit, you need to inform the data subject, so the access needs
to result in obtaining information, you have to inform the party about specific points (art. 12a
Directive), you really have to give it. Also, the data needs to be readable and intelligible
(page 108), so you can’t give a technical piece of data, for example numbers that refer to
different diseases or so, there really is a translation effort. Last week we discussed the
source of data, you can either get it from the person itself or through someone else.
Documenting the source of data should be understood as a plea that is often disregarded.
So the transparency of data is rare.
Profiling is a key research item for lawyers and others, we don’t know anything about it, not
how to regulate it. The logic has to be explained and data subject needs to be familiarized
with the logic of the whole profiling operation. Doesn’t mean that the algorithm is made free,
trade secrets and so on will still be secret, algorithms are still unknown, does google for
example even understand their own algorithms? It is a new subject, so there is a lot of
profiling that constitutes errors. When creating systems, it is unavoidable to make mistakes,
so the accountability system should be according to. We build systems and try not to think of
possible mistakes, but you make mistakes in the systems, perfectionists will never consider
mistakes, different point of view.
Case Rijkeboer wanted access to his data, but they deleted all data quite eagerly, they
wanted to limit the response time etc. The court said the right to access must relate to the
past, so you need to give all the data that you have. If it has been deleted, then you should
inform the subject about this deletion. The main thing is about control. Through access i can
be in your computer and see whether it is right or wrong.
Turkish case about police control, incorrect police control through data recording and the
court confirmed that they were incorrect and that they had the right to delete some of the
data.
The data subject rights are not often used, as they are for example unknown. We should be
on the shoulders of our bureaucrats and these data rights are a perfect means to bully them.
Right to access
Right to access is a fundamental right to have data access as a data subject. When we lift
the discussion up to a fundamental rights one, the constitution gets bigger and then the
discussion becomes symbolic. Article 8 of Convention 108 and article 12 of the Data
protection Directive. Exceptions can be overriding legal interests, public interests that are
more compelling than private interests, for example journalism. If a journalist is collecting
data on you, he could invoke a compelling interest in order not to give you the data until his
article has been published. You can see that the legal provisions are a way of applying the
human rights principles. Another exception is article 9 Convention and 13 Directive for the
purpose of scientific research. However, there is a proportionality reasoning in this exception
that has to do with the cost. At page 109 there is the right to rectification and the right to
object on page 112. The right to access has been acknowledged by the court in the Leander
case, the court said that it follows from article 8 that you have an access right. So from the
right to privacy, the right to access follows. This is creating new rights, right to privacy is a
trigger for new rights. Everyone in paragraph 2 has the right to access.
The Directive is the most explicit, you need to inform the data subject, so the access needs
to result in obtaining information, you have to inform the party about specific points (art. 12a
Directive), you really have to give it. Also, the data needs to be readable and intelligible
(page 108), so you can’t give a technical piece of data, for example numbers that refer to
different diseases or so, there really is a translation effort. Last week we discussed the
source of data, you can either get it from the person itself or through someone else.
Documenting the source of data should be understood as a plea that is often disregarded.
So the transparency of data is rare.
Profiling is a key research item for lawyers and others, we don’t know anything about it, not
how to regulate it. The logic has to be explained and data subject needs to be familiarized
with the logic of the whole profiling operation. Doesn’t mean that the algorithm is made free,
trade secrets and so on will still be secret, algorithms are still unknown, does google for
example even understand their own algorithms? It is a new subject, so there is a lot of
profiling that constitutes errors. When creating systems, it is unavoidable to make mistakes,
so the accountability system should be according to. We build systems and try not to think of
possible mistakes, but you make mistakes in the systems, perfectionists will never consider
mistakes, different point of view.
Case Rijkeboer wanted access to his data, but they deleted all data quite eagerly, they
wanted to limit the response time etc. The court said the right to access must relate to the
past, so you need to give all the data that you have. If it has been deleted, then you should
inform the subject about this deletion. The main thing is about control. Through access i can
be in your computer and see whether it is right or wrong.
Turkish case about police control, incorrect police control through data recording and the
court confirmed that they were incorrect and that they had the right to delete some of the
data.
