GDPR Article 19: Notification Obligation

GDPR Article 19 is Notification obligation regarding rectification or erasure of personal data or restriction of processing.

What it is 

This is where the company has to tell their 3rd party companies when a user’s data has been updated or removed. Unless it is too hard for the company to do so.

The organization needs to inform any processing company that has access to the personal data when a user has requested rectification, or deletion of data, or when that data changes. The exception is if it is too difficult to track in which case a company may state that it involves disproportionate effort.

Why it is important for the Data Subject

A user’s contact information needs to be accurate to continue service. Additionally, data can be used to make assumptions about the user’s interests or habits. Having those reflect accurately for the user is important.

What it means to the organization 

If an organization has a third party process data, the data may need to be updated to get appropriate results.

Real world example 

A political campaign canvases a neighbourhood to inquire about political opinions. They gather subject’s names, addresses, and interests. They contract a third party company to mail out pamphlets based on those interested. One individual has moved and informs the campaign of their change of address (rectification of data). The campaign notifies their third party mailing company of the change.

Questions about GDPR and the Data Subject Rights? Check out our full article on GDPR or contact us.