Digital rights resources

Resources for data subjects, collected in the context of the Repair Cafés for Digital Rights - BXL project.

Data Protection Authorities (DPAs)

Austria

The Datenschutzbehörde (DSB) provides a short summary of data subject rights (in English), and bilingual templates, notably:

to submit an access request (Art. 15 GDPR);
to submit a rectification request (Art. 16 GDPR);
to submit a request for erasure (Art. 17 GDPR);
to request a restriction of processing (Art. 18 GDPR);
to submit a data portability request (Art. 20 GDPR);
to exercise the right to object (Art. 21 GDPR).

Belgium

The Gegevensbeschermingsautoriteit (GBA) / Autorité de Protection des Données (APD) provides basic information on how to exercise data subject rights (in Dutch and French), and offers downloadable online templates:

to submit an access request (Art. 15 GDPR): in Dutch and French.
to submit a rectification request (Art. 16 GDPR): in Dutch and French.
to submit a data erasure request (Art. 17 GDPR): in Dutch and French.
to request the restriction of processing (Art. 18 GDPR): in Dutch and French.
to submit a data portability request (Art. 20 GDPR): in Dutch and French.
to exercise the right to object (Art. 21 GDPR): in Dutch and French.
to exercise the right to object to direct marketing (Art. 21(2) GDPR): in Dutch and French.
to request not to be subject to a decision based solely on automated processing, including profiling (Art. 22 GDPR): in Dutch and French.

France

The Commission Nationale de l'Informatique et des Libertés (CNIL) offers guidance on how to find the contact details of entities in order to excercise data subject rights (in French), and costumazibale online templates:

to submit an access request (Art. 15 GDPR): in French;
to submit an access request (Art. 15 GDPR) to a financial institution: in French;
to submit an access request (Art. 15 GDPR) regarding video-surveillance images: in French;
to request the rectification of incomplete data (Art. 16 GDPR): in French;
to request the rectification of inaccurate data (Art. 16 GDPR): in French;
to submit a data erasure request (Art. 17 GDPR): in French;
to request the closing of an online account and the deletion of all related data (Art. 17 GDPR): in French;
to exercise the right to object (Art. 21(1) GDPR): in French;
to exercise the right to object to direct markeing (Art. 21(2) GDPR): in French.

The CNIL also offers a useful app to visualise tracking by cookies, Cookieviz.

Germany

The Federal Commissioner for Data Protection and Freedom of Information (BfDI) provides online condensed information on the right of access (in German and English), and about other rights (in German), and made available a special leaflet ('Meine Rechten', January 2019, in German).

Italy

The Garante per la Protezione dei Dati Personali (Garante) offers basic information on data subject rights (in Italian), and a general template for the exercise of data subject rights, in Italian (in Word or PDF).

The Netherlands

The Autoriteit Persoonsgegevens (AP) offers, in Ducth, general information on data subject rights, as well as more specific information on the right to be informed, the right of access, the right to rectify, the 'right to be forgotten', the right to data portability, the right to object, the right to restriction of processing, and the right to human look into automated decisions, and offers templates:

to submit an access request (Art. 15 GDPR): in Dutch;
to submit a rectification request (Art. 16 GDPR): in Dutch;
to exercise the right to erasure ('right to be forgotten') (Art. 17 GDPR): in Dutch;
to request a restriction of processing (Art. 18 GDPR): in Dutch;
to exericse the right to data portability (Art. 20 GDPR): in Dutch;
to exercise the right to object (Art. 21(1) GDPR): in Dutch;
to exercise the right to object to direct marketing (Art. 21(2) GDPR): in Dutch;
to request a human intervention in automated decisions (Art. 22 GDPR): in Dutch.

Spain

The Agencia Española de Protección de Datos (AEPD) provides basic information on data subject righs (in Spanish), and offers templates:

to submit an access request (Art. 15 GDPR): in Spanish;
to submit a rectification request (Art. 16 GDPR): in Spanish;
to submit a data erasure request (Art. 17 GDPR): in Spanish;
to request a restriction of processing (Art. 18 GDPR): in Spanish;
to exercise the right to data portability (Art. 20 GDPR): in Spanish;
to exercise the right to object (Art. 21 GDPR): in Spanish (model A for Art. 21(1), model B for Art. 21(2) GDPR);
to request not to be subject to a decision based solely on automated processing, including profiling (Art. 22 GDPR): in Spanish.

Civil society

Online tools and templates

MyData Done Right: collaborative effort bringing together different European actors, details here.
Subject Access Request by PersonalData.Io: a 'one-click' solution for some data access requests.
'A better data access request template', including data portability, by Michael Veale.

Other initiatives

NoyB: the Vienna-based NGO provides practical guidance on how to exercise data subject rights:
- 'Exercise your rights!' general page;
- 'Right of access' page;
- 'Right to withdrawal of consent' page.
Privacy International '7+1 tips on how to make the most out of your DSAR'.