» »
CNIL, ‘La réutilisation des données publiquement accessibles en ligne à des fins de démarchage commercial’ https://www.cnil.fr/en/node/119840
2.5. What are the data subjects’ rights? 2.5.1. Background Under the GDPR, data subjects have a set of rights relating to their 2. Personal data protection basics
personal data. In practice, these rights place obligations upon data controllers.106 SMEs acting as data controllers have a responsibility to respond to queries from data subjects about the exercise of their rights. SMEs acting as processors may also play a part in this; they are likely to be requested to assist the controllers through the provision of appropriate technical and organizational measures to grant data subjects their rights when this is possible.107
SUGGESTION The written agreement between the controller and the processor may clarify how the processor will practically assist the controller in complying with data subjects’ requests.
106 Ausloos, J., Mahieu, R. and Veale, M., ‘Getting Data Subject Rights Right’ (2019) 10 JIPITEC 283 https://ssrn.com/abstract=3544173. 107 Article 28(3)(e) GDPR.
62
