| Abstract [eng] |
EU General Data Protection Regulation, which came into force on 25 May 2018, introduces a brand new right to data portability. Also, the updated right not to be subject to automated decisions was transfered from the Article 15 of Data Protection Directive. These two rights are particularly relevent now, when personal data is becomg a main source of income for many digital companies and it is used to predict a person‘s behavior and thus influences their choices. Therefore, the aim of this thesis is to analyze the content of the right to data portability and the right not to be subject to automated decisions, its elements and to analyze issues related to them. The analysis reveals that the right to data portability consists of two rights: the right to receive the personal data and the right to transmit the data to another controller. The latter right is supplemented by the data subject right to have their personal data transmitted directly from one controller to another, where technically feasible. The analysis found that most elements of this right are not clearly defined. Also, restrictions on the application of the right are too restrictive, their current interpretation is insufficient and contradictory. These shortcomings may adveresly affect the goal to grant data subject with the better control of their personal data. The right not to be subject to automated decisions, including profiling can be only applied when there is no person is involved in the automated decision making process. Such a limitation is considered to significantly reduce the data subject‘s ability to exercise this right and its protection. It is also unlcear whether the right not to be subject to automated decisions is a right or a ban. Also, a human role in the automated decision making is another problematic aspect and is lacking a more detailed regulation. Therefore, it is assessed that these aspects may hinder the implementation of the right and the effective protection of data subjects. |
