Browsing by Subject "Object"

Abstract This thesis conceptualizes how the selection of lawful bases for processing by controllers upholds or constrains data subjects' rights to erasure ("right to be forgotten"), restriction, and objection to processing personal data under the GDPR, particularly when data subjects assert these rights. This thesis asks two research questions to achieve this: How do the prioritization and relative authority – as represented by the non-absoluteness of the right to data protection - of different lawful bases under GDPR influence the applicability of data subjects' rights to erasure, restriction, and objection; and how do specific contextual factors recognized by the GDPR, such as data subject vulnerability and exceptional processing circumstances, influence the applicability of lawful bases and the consequent exercise of data subjects' rights to erasure, restriction, and objection? Given the nature of the above research questions that touch upon the interpretation of letters of the law, this thesis employs a legal doctrine approach with limited exposure to social science, and therefore, resources from both fields are used given this limitation. To address the first research question, this thesis categorizes the rights to erasure, restriction, and objection according to the lawful bases used for processing, aiming to decode their interrelationships. My findings reveal that all GDPR provisions embed the non-absolute nature of data protection rights; however, they disproportionately manifest this nature within these three specific rights due to the peculiarities of the chosen lawful bases and the processing contexts. Some rights are significantly more impacted than others. This thesis argues that lawful bases for processing carry an implicit hierarchical order, considerably influencing the enforcement of subjects' rights to erasure, restriction, and objection in a direct proportion relationship. To address the second research question, this thesis categorizes the contexts of processing deemed exceptional due to either the inherent processing risks involved or implicitly recognized favored societal interests. My analysis reveals that these processing contexts impact the rights to Erasure, Restriction, and Objection, as they influence the selection of the lawful base for processing and consequently modulate the interplay identified in the initial research question. In essence, the context introduces an additional layer of protection, tempering the degree of non-absoluteness of data protection right while negatively impacting the three rights in other contexts.