There are several provisions of the DGA, DMA, DSA, and the proposed EHDS and AI Act regulations that intersect those of the GDPR realizing on various issues a composite discipline from multiple sources. 

In this round, we will focus on the news concerning the:

• Exercise of rights  
• Right of access  
• Right to data portability  
• Right to rectification.

Summary

Exercise of rights

The EU’s data regulatory acts on several occasions have intervened to recognize rights that sometimes intersect with privacy rights enshrined in the GDPR.

The rights under Articles 15-22 of the GDPR are granted to the data subject as an expression of his or her power to control the use that is made of his or her personal data. Similar rights are sometimes granted to third parties for different purposes, and these rights may sometimes also involve personal data, creating interference with the data subject’s privacy rights. In some circumstances, as in the case of access to administrative documents, this interference is solved by finding a fair balance between the underlying conflicting rights; other times, as in the case of the regulatory acts for the Union’s digital strategy, the prevalence of the privacy discipline is recognized, whereby the exercise of rights by third parties is subject to the prior information (privacy notice) of the data subject and his or her specific authorization (consent).

The DGA contains provisions to facilitate the exercise of privacy rights by the data subject. This aim is pursued with the provision: 

• Of the obligation for intermediaries to make available to data subjects mechanisms that make it easy for them to become aware of and effectively exercise their privacy rights
• of the new figure of data cooperatives, i.e., “a specific category of data intermediation service providers (…) who offer their services to data subjects“ by assisting them in granting or withdrawing consent to data processing, exercising rights, and ensuring that data subjects are not incentivized to provide more data “than is in their own interest” [Recital (30-31), Art. 2(15), DGA].

More specifically, with the use of intermediaries and data cooperatives, the DGA addresses the issue of how to exercise rights to ensure their effectiveness and efficacy.