The right to restrict processing gives the individual the ability to have processing of personal data restricted where one of the following applies:
- The accuracy of the personal data is contested by the individual, but the restriction only applies until the accuracy of the personal data is verified
- The processing is unlawful, but instead of erasure of the personal data the individual wants restriction of the personal data’s use
- The personal data are no longer needed for the purposes of the processing, but the individual needs the personal data to establish, exercise or defend a legal claim
- The individual has objected, and the restriction applies until the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the individual or to establish, exercise or defend legal claims.
Where processing has been so restricted, such personal data can be stored, but otherwise it can only be processed with the individual’s consent and in order to establish, exercise or defend legal claims or to protect the rights of another individual or for reasons of important public interest.
The restriction of processing cannot be lifted before the individual who has obtained the restriction of processing has been informed.
Any restriction of processing must be disclosed to each recipient to whom the personal data have been disclosed, unless it is impossible or involves disproportionate effort. The individual must be informed about those recipients if he or she so requests.
This blog is the eighth in a series of blogs that describes and explains the eight individual rights set forth in the GDPR. If you don’t want to wait until the next blog to learn more about the GDPR and the individual rights in the GDPR, take a look at GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, that can help SMEs implement the GDPR and demonstrate their implementation.
Next blog: What is the right to data potability?