{"id":5466,"date":"2023-04-19T12:34:24","date_gmt":"2023-04-19T12:34:24","guid":{"rendered":"https:\/\/exciting-panini.13-37-234-21.plesk.page\/?p=5466"},"modified":"2024-07-23T13:53:56","modified_gmt":"2024-07-23T13:53:56","slug":"exercice-des-droits-dacces-portabilite","status":"publish","type":"post","link":"https:\/\/viqtor.eu\/en\/exercice-des-droits-dacces-portabilite\/","title":{"rendered":"Exercising access rights, portability: what are the powers of a representative?"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Exercice\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

Exercising access rights, portability: what are the powers of a representative?<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\n

Legal Watch No. 35 \u2013 May 2021<\/strong><\/p>\n\n\n\n

Exercising access rights, portability: what are the powers of a representative?<\/strong><\/a> Some data controllers were able to legitimately express their perplexity upon receiving a request from a company mandated to obtain data from their customer file<\/strong>, especially when the request contains particularly broad requirements, for example concerning the transfer of personal data without time limitation, or requiring automatic access to the data.<\/p>\n\n\n\n

The manager may legitimately question the risks of reusing his customer data, and the possible distortions of competition that would result from this.<\/p>\n\n\n\n

In principle, however, the practice is legal.<\/p>\n\n\n\n

It is provided for by the GDPR and Article 77 of the implementing decree of the Data Protection Act, and aims to facilitate the exercise of rights of access, opposition or even data portability by allowing the persons concerned to call upon a representative to exercise their rights.<\/p>\n\n\n\n

How can we preserve individuals' control over their data by allowing a third party to exercise these rights, while avoiding the abuses that could result from abusive mandates?<\/strong><\/p>\n\n\n\n

It is up to the agent to clearly define the scope of his mandate, and to the manager who receives such a request to verify the validity of this mandate.<\/p>\n\n\n\n

The CNIL recently launched a public consultation on a draft recommendation aimed at clarifying the framework of this new practice.<\/p>\n\n\n\n

It has also published a standard mandate which can serve as a reference for agents and data controllers.<\/p>\n\n\n\n

Certain aspects deserve particular attention, and could justify a data controller requesting additional details before transmitting the data concerned.<\/strong><\/p>\n\n\n\n

\u2022 Data allowing the clear identification, in the mandate, of the person for whose benefit the rights are exercised (for example, identifier, date of birth, date of last connection)<\/p>\n\n\n\n

\u2022 The identification of the recipient to whom the data is transmitted (which may be the agent or the person concerned)<\/p>\n\n\n\n

\u2022 The authenticity of the mandate (existence of an electronic signature), its scope and duration. The data or categories of data must be specified. The CNIL considers that a mandate established for an indefinite period does not meet the requirements of the law.<\/p>\n\n\n\n

\u2022 If the transfer is carried out electronically, in particular via an application programming interface (API), this must be stable, have a high level of availability, and integrate security measures adapted to the risks. The CNIL has reservations about scraping techniques which allow the username and password to be retrieved from the person concerned in order to extract the data automatically.<\/p>\n\n\n\n

If the data controller has doubts about the validity of a mandate, it must justify its refusal to grant the access request in accordance with Article 12.6 of the GDPR.<\/strong><\/p>\n\n\n\n

This could be the case, for example, if there are reasonable doubts about the identity of the person concerned, which will require collecting additional information from that person or the agent.<\/p>\n\n\n\n

In the case of a mandate, as for a classic access request, the response time from the data controller is one month.<\/p>\n\n\n\n

What about the possible reuse of this data by the agent for its own purposes?<\/strong><\/p>\n\n\n\n

This is a separate processing operation that must comply with the legality requirements of the GDPR.<\/p>\n\n\n\n

The person concerned should in any event have the choice of accepting or not, on a case-by-case basis, each reuse which would be envisaged by the agent.<\/p>\n\n\n\n

Note that the CNIL, like the European Data Protection Committee, considers that "agents should not reuse data relating to third parties for their own purposes", which would be considered an infringement of the rights and freedoms of third parties.<\/p>\n\n\n\n

<\/p>\n\n\n\n

And also<\/strong><\/p>\n\n\n\n

France:<\/strong><\/p>\n\n\n\n

In its 2020 activity report, the CNIL<\/strong> takes stock of the highlights of the year, and in particular the impact of the pandemic crisis on fundamental rights.<\/p>\n\n\n\n

Three years after the entry into force of the GDPR, she notes a constant increase in the number of complaints<\/strong> \u2013 more than 62% this year, and issued 14 sanctions including 11 fines totaling 138 million euros.<\/p>\n\n\n\n

THE Commission priorities<\/strong> include<\/p>\n\n\n\n