VIII. Rights of the data subject

4. Right to erasure

a) Erasure obligation
The data subject may request the controller to erase his/her personal data without delay, in which case the controller is obliged to erase the data without delay where one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
• The data subject withdraws the consent on which the processing is based pursuant to Art. 6 no. 1 lit. a or Art. 9 no. 2 lit. a GDPR, and there are no other legal grounds for the processing.
• The data subject objects to the processing of his/her data pursuant to Art. 21 no. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing of his her data pursuant to Art. 21 no. 2 GDPR.
• The user's personal data was processed unlawfully.
• The personal data has to be erased for compliance with a legal obligation in EU or member state law to which the controller is subject.

b) Information to third parties
If the GFZ’s controller, acting on behalf of ICDP, has made the data subject’s personal data public and is obliged pursuant to Art. 17 no. 1 GDPR to erase it, the controller, taking account of the technology available and the cost of implementation, must take reasonable steps, including technical measures, to inform controllers who are processing the personal data that the data subject has requested the erasure of any links to, or copy or replication of, his/her personal data

c) Exceptions
No right of erasure exists if the data has to be processed

• to exercise a right to freedom of speech and information;
• for compliance with a legal obligation according to which processing is required by EU or member state law to which the controller is subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Art. 9 no. 2 lit. h, i and Art. 9 no. 3 GDPR;
• for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes pursuant to Art. 89 no. 1 GDPR, insofar as the right referred to in point a is likely to render impossible or seriously impair the achievement of the objectives of the processing; or
• for the establishment, exercise, or defence of legal claims.

5. Right to notification
If the data subject exercises his/her right to rectification or erasure of personal data or restriction of processing, the controller is obliged to communicate this to all recipients to whom the personal data has been disclosed unless this proves impossible or involves disproportionate effort.

The GFZ’s controller, acting on behalf of ICDP, is obliged to inform the data subject about these recipients if so requested.

6. Right to object
The data subject has the right to object at any time, on grounds relating to his/her particular situation, to any processing of his/her personal data effected on the basis of Art. 6 no. 1 lit. e or f GDPR.

If this right is exercised, the GFZ’s controller, acting on behalf of ICDP, will cease processing this personal data unless he/she can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or if the data has to be processed for the establishment, exercise, or defense of legal claims.

7. Right to revoke the declaration of consent provided in compliance with data protection legislation
The data subject has the right to withdraw his/her consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing effected on the basis of the data subject’s consent before its withdrawal.

8. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with a supervisory authority, in particular in the member state of his/her habitual residence, place of work, or place of the alleged violation, if the data subject considers that the processing of his/her personal data violates the GDPR.