Personal Data Protection and Safeguarding Draft Act June 2019 In comparison, the Draft Act has a limited provision, which is largely unclear in its application and limitations. Article 10 of the Draft Act states that “the person has the right to access their own data with the aim of processing them". There are two limitations to the access: ● Data does not include public classified information or other people’s private data; and ● Referability of data is not disturbed. The provision does not define what “public classified information” means. Further, Article 26 obligates the processor to provide information on the purposes, sources, obligations, and uses of the information but not clearly the data itself. Significantly, in the Draft Act the right to correction is not specifically granted. General Comment No. 16 states: If such files contain incorrect personal data or have been collected or processed contrary to the provisions of the law, every individual should have the right to request rectification or elimination.101 Under the GDPR, the controller should also “use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests".102 It also provides for a “right to rectification”, namely “the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement".103 Recommendations ● Clarify Article 10 to ensure that persons have full and free access to their personal information held by third parties except in limited instances allowed under international law, most notably General Comment No. 16. Define what “public classified information” means under Article 10. ● Grant data subjects a right of correction. E. Independence of the Data Protection Commission and Other Oversight Bodies ARTICLE 19 is highly concerned about the independence of the body in charge of overseeing the application of the Personal Data Protection and Safeguarding Draft Act. This is a crucial aspect of the Draft Act as the guarantee of independence of national data protection supervisory authorities is intended to ensure the effectiveness and reliability of the supervision of compliance with the provisions on the right to data protection. It follows that, when carrying out their duties, supervisory authorities must act objectively and impartially without any external influence, including the direct or indirect influence of the government. 1. Structure and Powers The Draft Act sets out a complex structure of entities that are in charge of the implementation of the data protection rules. The five bodies involved are: the Data Protection Commission, Supervisory Board, Commission Secretariat, specialised expert working groups, and the Special Supervisor. 101 General Comment 16, ibid at §10. 102 GDPR, Recital 64. 103 GDPR, Article 16. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 31 of 58