Recommendation 21

Given that many people will have consented to their personal data being shared without being in a position to understand what they were agreeing to, that people’s data is being shared without their consent and that inferences are being drawn from people’s data to create a profile of them that may be entirely incorrect, it is vital that companies make it easy for people to correct or remove data held about them. While the GDPR gives individuals the rights to have their personal data erased and rectified, the evidence we heard suggests that these are not always adequately enforced. Companies must respect people’s right to privacy, and make it easier for people to limit or stop how their data is being shared. We consider that these rights could be more effectively enforced if specific sanctions were associated with non-compliance of these rights by companies, particularly when companies fail to respond promptly or adequately to individual’s requests to rectify or delete their data. (Paragraph 78) The risk of discrimination