Skip to main content
Hafan

What data protection rights do people have?

Download options

Contents

People have a range of rights under data protection legislation. You must ensure that they are able to exercise their data protection rights. This also helps you comply with other data protection requirements, such as the principles.

The lawful basis you use for your processing can affect which rights are available to people.

This section considers people’s data protection rights that may be most relevant to your content moderation processes.

Can people request access to their personal information used in content moderation?

Yes. People have the right to access the personal information you use and generate through your moderation activities. You must provide this information if a user makes a subject access request (SAR), unless an exemption applies.

In content moderation, depending on the nature of the SAR, you may need to provide users with:

  • confirmation that you are using their personal information to carry out content moderation;
  • copies of the personal information you are using; and
  • copies of personal information generated in your moderation systems (eg information on the content moderation outcome or action you’ve taken about the user or their content).

People are only entitled to their own personal information. This means that you do not need to provide additional information that is not personal information (eg confidential commercial information).  

It may be challenging to respond to SARs if your systems use large amounts of information or the information contains details of other users. You should store the information in a way that makes it quick and easy for you to locate it.

If you are using third-party moderation providers, you should ensure that any personal information they use or generate is readily retrievable. You should factor this in when choosing your third-party moderator(s).

Can people request that we rectify their personal information used in content moderation?

Yes. People have the right to have inaccurate personal information rectified. If you receive a request for rectification, you must take reasonable steps to satisfy yourself that the information is accurate and to rectify it, if necessary. You should take into account the arguments and evidence provided by the person whose information you are using.

This is closely linked to the accuracy principle. However, even if you took steps to ensure personal information was accurate when you gathered or generated it, the right to rectification means you must reconsider its accuracy, if a person makes a request.

For example, your content moderation system may generate personal information about a user that states that they posted a piece of content  that breaches your content policies. Even if you took steps to ensure your systems were functioning as intended, you must ensure the outcome you recorded about that user is accurate. You should consider any argument the user puts forward about that decision, and you must rectify the information, if needed.

Further reading