Personal Data Protection Act (PDPA) of Sri Lanka — Data Subject Rights

_(ツ)/¯༼ つ ◕◕ ༽つ(••)☆: .｡. o(≧▽≦)o .｡.:☆\^o^/༼ つ ◕◕ ༽つ¯_(ツ)_/¯

Photo by Markus Spiske on Unsplash

What are the Data Subject Rights under PDPA? The Data Subject Rights in the Personal Data Protection Act of Sri Lanka are important provisions that allow individuals to manage their personal information.

This Act has seven sections that describe these key rights;

13. Right of access to personal data

14. Right of withdrawal of the consent and the right to object to processing

15. Right to rectification or completion

16. Right to erasure

17. Grant or refusal of rectification, completion, erasure or refrain from further processing

18. Automated individual decision making

19. Right of appeal of the data subjects to the Authority and the process of determination of such appeal

Right of access to personal data

1. The data subject wants to know if their personal data has been processed and if the information required under Schedule V applies.
2. The data subject submits a written request to the data controller.
3. The data controller provides the information required under Schedule V or denies the request according to section 17, which addresses the grant or refusal of rectification, completion, erasure or refraining from further processing.

References

Schedule V — Collection of Personal Data

Section 17 — Grant or refusal of rectification, completion, erasure or refrain from further processing

Right of withdrawal of the consent and the right to object to processing

1. The data subject has the right to withdraw their consent at any time.
2. To withdraw consent, the data subject must submit a written request.
3. This right applies if the processing is based on the grounds specified in item (a) of Schedule I or item (a) of Schedule II.
4. The withdrawal of consent does not affect the legality of any processing that occurred before the withdrawal.
5. The data subject can also request that the controller refrain from further processing their personal data.
6. This request must be made in writing.
7. This right to refrain from processing applies if the processing is based on the grounds specified in items (e) or (f) of Schedule I or item (f) of Schedule II.

References

Schedule I (a) — the data subject has given consent to the processing of personal data

Schedule II (a) — the data subject has given consent to the processing of special categories of personal data

Schedule I (e) — processing is necessary for the performance of a task carried out in the public interest or in the exercise of powers, functions or duties conferred, imposed or assigned on the controller or processor by or under any written law including any circular, direction or code issued by the government

Schedule I (f) — processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests of the data subject which require protection of personal data, in particular where the data subject is a child.

Schedule II (f) — processing is necessary for, any purpose as provided for in any written law or public interest as determined under item (g) of Schedule I, which shall be necessary and proportionate to the aim pursued whilst providing suitable and specific measures to safeguard the rights and freedoms of the data subject

Schedule II (g) — processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where such data is processed by a health professional licensed under or authorized by any written law prevailing in Sri Lanka

Right to rectification or completion

1. Data subject has the right to request the controller to rectify or complete their personal data.
2. This request must be made in writing.
3. The personal data must be either inaccurate or incomplete for the request to be valid.
4. Upon receiving the written request, the controller must rectify or complete the personal data without undue delay.
5. This process is subject to the provisions of section 17.
6. The controller is not obligated to collect or process any additional personal data that is not required for the purpose of processing.
7. If the controller is required to maintain personal data for evidentiary purposes under any written law or by order of a competent court, they must refrain from further processing that personal data without rectifying it.

Reference

Section 17 — Grant or refusal of rectification, completion, erasure or refrain from further processing

Right to erasure

1. Every data subject has the right to make a written request to the controller to have their personal data erased.
2. This right applies under specific circumstances: a. If the processing of personal data is carried out in violation of the obligations outlined in sections 5, 6, 7, 8, 9, 10 and 11. b. If the data subject withdraws their consent upon which the processing is based, in accordance with item (a) of Schedule I or item (a) of Schedule II. c. If the requirement to erase personal data is mandated by any written law or by an order of a competent court to which the data subject or controller is subject.

References

Section 5 — Obligation to process personal data in a lawful manner

Section 6 — Obligation to define a purpose for personal data processing

Section 7 — Obligation to confine personal data processing to the defined purpose

Section 8 — Obligation to ensure accuracy

Section 9 — Obligation to limit the period of retention

Section 10 — Obligation to maintain Integrity and confidentiality

Section 11 — Obligation to process personal data in a transparent manner

Schedule I (a) — the data subject has given consent to the processing of personal data

Schedule II (a) — the data subject has given consent to the processing of special categories of personal data

Grant or refusal of rectification, completion, erasure or refrain from further processing

1. The data controller can grant or refuse requests for rectification, completion, erasure or to refrain from further processing personal data.
2. Upon receiving a written request from a data subject under sections 13, 14, 15 or 16, the controller must inform the data subject in writing within one month of the receipt.
3. The response must indicate whether the request can be granted or refused, along with the reasons for the decision, unless prohibited by any written law.
4. The controller may refuse to act on a request based on several considerations, including: a. National security. b. Public order. c. Ongoing inquiries, investigations, or procedures under any written law. d. Prevention, detection, investigation, or prosecution of criminal offenses. e. Rights and freedoms of other persons under any written law. f. Technical and operational feasibility of acting on the request. g. Inability to establish the identity of the data subject. h. Requirement to process personal data under any written law.
5. The controller must record the reasons for any refusal and submit these records to the Authority upon request.
6. If the controller cannot establish the identity of the data subject making a request, they may ask the data subject for additional information to process the request.
7. Rights conferred on a data subject can be exercised by: a. Parents or guardians for minors. b. A person appointed by a court for individuals who are physically or mentally unfit. c. A person authorized in writing by the data subject, except in cases involving minors or individuals unfit to act. d. An heir exercising the rights of a deceased data subject within ten years of their death as prescribed by regulations.
8. If a controller requires an extension of the time period, they may request an extension for specific reasons.
9. The extension can be granted for an additional period of up to two months, but the total time period must not exceed three months from the date the request was received.
10. If the time period is extended, the controller must inform the data subject about the extension before the expiry of the initial one-month period.
11. The controller is also required to inform the data subject about their right to appeal to the Authority regarding the refusal of a request made under sections 13, 14, 15, 16, or 18.
12. Any request made by a data subject under sections 13, 14, 15, 16, or 18 must be complied with by the controller free of charge.
13. However, the Authority may establish rules that determine the criteria or circumstances under which a fee may be charged by the controller to fulfill such requests.

References

Section 13 — Right of access to personal data

Section 14 — Right of withdrawal of the consent and the right to object to processing

Section 15 — Right to rectification or completion

Section 16 — Right to erasure

Section 18 — Automated individual decision making

Automated individual decision making

1. The data subject has the right to request the controller to review a decision made solely based on automated processing.
2. This right applies if the decision has created or is likely to create an irreversible and continuous impact on the rights and freedoms of the data subject under any written law.
3. However, this right does not apply in the following situations: a. If the decision is authorized by any written law to which the controller is subject. b. If the decision is authorized in a manner determined by the Authority. c. If the decision is based on the consent of the data subject. d. If the decision is necessary for entering into or performing a contract between the data subject and the controller.
4. The controller must comply with measures and applicable criteria specified by the Authority to safeguard the rights and freedoms of the data subject.
5. This provision does not apply to special categories of personal data.

Right of appeal of the data subjects to the Authority and the process of determination of such appeal

1. If a controller rejects a data subject’s request, the data subject has the right to appeal against the decision.
2. The appeal must be made in the form, manner and within the time period prescribed by regulations.
3. The Authority will determine whether the rejection of the request is lawful.
4. After conducting the necessary investigations, the Authority will decide whether to allow or disallow the appeal within a prescribed period.
5. The Authority will inform both the data subject and the controller of its determination, along with the reasons for the decision.
6. If the Authority allows the appeal, the controller must take steps to implement the Authority’s decision within the timeframe determined by the Authority.
7. The controller must inform both the data subject and the Authority of the steps taken to comply with the decision.
8. Any data subject or controller dissatisfied with the Authority’s decision may appeal to the Court of Appeal within thirty days from the date of the decision.