Editing General Data Protection Regulation (section)

===Chapter 3: Rights of the data subject===

Chapter 3 of the GDPR covers transparency, information and access to personal data, the right to change, erase, or restrict processing of personal data, and the right to object.<ref>[https://gdpr-info.eu/chapter-3/ "Chapter 3: Rights of the data subject"] - gdpr-info.eu - 25 May 2018</ref>

====Article 17: Right to erasure (‘right to be forgotten’)====
''Main wiki: [https://gdprhub.eu/index.php?title=Article_17_GDPR Article 17 GDPR]''

Data subjects have the right to request erasure of their personal data by the data processor and the data processor is required to erase said data in a timely manner. This includes unnecessarily stored data, unlawfully processed data, and publically availabe information.

This article does not cover free of expression and information, public interest, archiving purposes, or legally-relevant information.

====Article 21: Right to object====
''Main wiki: [https://gdprhub.eu/index.php?title=Article_21_GDPR Article 21 GDPR]''

Data subjects have the right to object to processing of their personal data in several key contexts, including when processing is based on public interest or legitimate interests grounds, for direct marketing purposes, or for research purposes - and in the case of direct marketing, this objection must be honored without exception.

When such an objection is made, the controller must cease processing unless they can demonstrate compelling legitimate grounds that override the data subject's rights and freedoms, with special provisions requiring that this right to object must be explicitly communicated to data subjects and made easily accessible, particularly in digital contexts.
====Article 22: Automated individual decision-making, including profiling====
''Main wiki: [https://gdprhub.eu/index.php?title=Article_22_GDPR Article 22 GDPR]''

Under Article 22, individuals have the right to not be subject to decisions based solely on automated processing or profiling that have legal or similarly significant effects, with three key exceptions: when the automated decision is necessary for a contract, authorized by law, or based on explicit consent. 

When automated decisions are made under contractual necessity or explicit consent, the data controller must implement safeguards including human intervention options, allowing individuals to express their views and contest decisions. Automated decisions cannot be based on special categories of personal data (such as race, health data, or political opinions) unless specific conditions are met and appropriate safeguards are in place.