EDPB SPE project: Article 60 One-Stop-Shop thematic case digest analysing Articles 17 and 21. Key takeaway: Create, document, implement and control policies and procedures, including complaints management. PS: The 'data subject journey' is your secret weapon!
You have the right to a faithful and intelligible copy of all your personal data, even full documents or extracts from documents or databases, if that's crucial for your rights and while respecting others' rights and freedoms.
Another interesting case, interpreting the Art. 14(5)(c) derogation for the first time! It applies to all data not collected from the data subject, a DPA can check all conditions of it, and the 'measures' aren't related to Art. 32.
Interesting views on invalid consent and insufficient basis in Union or national 🇧🇬 laws for relying on Art. 6(1)(c) and (e), cf. 6(3)—and implications for erasure requests.
You have the right of access to data processed before the GDPR took effect, if you requested it after that date, and to know when and why it was accessed—but not by whom, unless crucial for your rights and while respecting others' rights and freedoms.
Consent is required for listing subscribers' details in publicly available directories. If you obtain it, including on behalf of other controllers, a data subject can withdraw it (which equates to an erasure request) from any of these, and every controller may be required to notify the others.
Police must regularly review if they can justify to continue storing biometric and genetic data and, if this isn't the case, grant erasure requests. This ruling applies to Directive (EU) 2016/680 (LED).