In our previous article on ‘Powers of the data subject’, we looked at three provisions that grant specific powers to the data subject; the right to access, right to object and the right to restrict processing of personal data.

In this article, we highlight three more of these powers; the right to personal data portability, the right to rectification of personal data, and the right to erasure of personal data.

Right to personal data portability (Art. 20)

This right to personal data portability allows individuals to obtain and reuse their personal data for their own purposes across different services, making it easier for a data subject to reuse his or her information in another context without hindrance.

As stated in Article 20:

The data subject has the right to request the data controller in writing or electronically to resend the personal data concerning him or her as it was provided to the data controller, in a structured and readable format.

The data subject also has the right to request the data controller in writing or electronically to have his or her personal data transmitted to another data controller, where technically feasible, without hindrance.

Right to erasure of personal data (Art. 23)

The right to erasure grants the ability to have personal data deleted if they don’t want them processed anymore and when there is no legitimate reason for a Data Controller to keep it.

As stated in Article 23:

The data subject has the right to request the data controller in writing or electronically for erasure of his or her personal data where:

1. The personal data are no longer necessary in relation to the purposes for which they were collected or processed.

2. The data subject withdraws consent on which the personal data processing is based and where there is no other legal ground for the processing.

3. The data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing.

4. The personal data have been unlawfully processed.

However, Article 23 also states that the right to request the erasure of personal data does not apply to the extent that processing is necessary:

1. For reasons of public interest.

2. For historical or scientific research purposes or statistical purposes.

3. For compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

4. For the establishment, exercise or defence of legal claims in the interest of the data controller.

Right to rectification of personal data (Art. 24)

If your personal data is inaccurate, you have the right to have the data rectified, by the Data Controller, without undue delay. If your personal data is incomplete, you have the right to have data completed, including by means of providing supplementary information.

As stated in Article 24:

The data subject has the right to request the data controller the rectification of his or her personal data. The data subject has the right to have incomplete personal data completed, where necessary.

For more information on the rights of the data subject: Rwanda’s law on personal data protection and privacy