The GDPR reforms existing data protection policy by imposing more stringent obligations on not only data controllers but also on data processors relating to obtaining a valid consent, ensuring transparency of automated decision-making and security of data processing, and by providing new rights for data subjects. Data subjects are entitled to withdraw their consent, request their data to be transferred to another data controller or to be deleted. Also, the GDPR includes certain principles aimed at regulating its cross border transfers of the EU citizens’ personal data to ensure a high level of protection outside the EU.
Ibid Art.4 (11); Art.7; Art.9
Ibid Art.22
Ibid Art.5;Art.28
IbidArt.7 (3)
Ibid Art.20
Ibid Art.17
Ibid Art. 3; Art.42; Art.44-46
The GDPR (n 4) Art. 6 (a)
Ibid Art.4 (11)
‘GDPR: Consent’(Intersoft Consulting) <https://gdpr-info.eu/issues/consent/#:~:text=GDPR%20Consent,has%20consented%20to%20the%20processing.&text=Consent%20must%20be%20freely%20given,given%20on%20a%20voluntary%20basis.> accessed 15 July 2020
Hoofnagle and Borgesius ( n 1) 79
Frederik J Zuiderveen Borgesius and others ‘Tracking Walls, Take-it-or-Leave-Choices, the GDPR and the E-Privacy Regulation’ European Data Protection Law Review (2017) 3 (3) 3
Ibid 6
The GDPR (n 4) Art. 7 (4)
Borgesius and others (n 19) 8
The GDPR (n 4) recital 43
Ibid recital 42
‘GDPR: noyb.eu filed four complaints over “forced consent” against Google, Instagram, WhatsApp and Facebook’ (Noyb 25 May 2018) < https://noyb.eu/en/gdpr-noybeu-filed-four-complaints-over-forced-consent-against-google-instagram-whatsapp-and> accessed 15 July 2020
Ibid
Deliberation of the Restricted Committee SAN-2019-001 of 21 January 2019 pronouncing a financial sanction against GOOGLE LLC. para.189 <https://www.cnil.fr/sites/default/files/atoms/files/san-2019-001.pdf> accessed 15 July 2020
Ibid para. 157
‘GDPR: Consent’ (n 15)
Article 29 Working Party, Guidelines on Consent under Regulation 2016/679 (10 April 2018) 14
Ibid 12
The GDPR (n4) Art.7 (3)
Ibid Art.20
Ibid Art.17
Ibid Art. 20 (1)
Ibid (2)
‘Right to Data Protability’ (Information Comissioner’s Office ) < https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/> accessed 20 July 2020
Ibid
ibid
The GDPR (n4) Art.7 (3)
ibid
ibid
The European Parliament and the Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L 281/31 Art.12
Case C-131/12 Google Spain SL, Google Inc. v Agencia Espanola de Datos (AEPD), Mario Costeja Gonzalez [2014] ECLI-317
Ibid para. 88
Ibid para.81
The GDPR (n 4) Art.17 (1)
Ibid Art.17 (3)
Eugenia Politou, Efthimios Alepis and Constantinos Patsakis ‘Forgetting personal data and revoking consent under the GDPR: Challenges and Proposed Solutions’ Journal of Cybersecurity (2018) 1 (20)
The GDPR (n4) Art.17 (2)
Case C-507/17 Google v. CNIL [2019] case in Harlan Grant Cohen ‘International Decisions’ The American Journal of International Law (2020) 114 (2)
ibid
ibid
The GDPR (n4) Art. 3 (1)
Ibid Art. 3 (2) (a)
Ibid Art. 3 (2) (b)