How to exercise your GDPR rights with an AI service
The procedure is the same as for any digital service: identify the data controller in the privacy policy, submit your request (access, erasure, objection), get a response within one month, and contact the CNIL if ignored or refused via its online complaint service. Sample request templates are included in the article.
Exercising your GDPR rights with an AI service follows the same procedure as for any digital service. You identify the data controller in the privacy policy, send them your request specifying the right invoked, they must respond in principle within one month, and you can contact the CNIL in case of silence or unjustified refusal. The rights that can be exercised are access, rectification, erasure, objection, restriction and portability. The process is free.
Step 1: identify the data controller
The service's privacy policy indicates who is responsible for processing your data and how to contact them, often via a data protection officer. This is who you address your request to.
Step 2: formulate the request
Specify the right you are exercising. For access, request communication of data concerning you. For erasure, request deletion. For objection, indicate the contested processing, for example the use of your conversations for training. Keep a written record of your request.
Step 3: the response time
The controller must respond within one month, extendable by two months in case of complexity, informing you accordingly. The absence of a response or an unjustified refusal opens the way to recourse.
Step 4: contact the CNIL
In case of silence, unjustified refusal or unsatisfactory response, you can file a complaint with the CNIL, free of charge, via its online complaint service. The CNIL investigates and can act against the non-compliant controller.
Sample request
An effective request includes your identity, the service concerned, the right exercised, the precise subject, and a request for a written response within the legal timeframe. The CNIL provides templates on its website.
Frequently Asked Questions
Is it free?
Yes, exercising your rights and contacting the CNIL are free.
How long for a response?
One month in principle, extendable in case of complexity with notification to you.
What if the service is outside Europe?
The GDPR applies as soon as the service targets people in the Union. You retain your rights and can contact the CNIL.
ICIA Resource
ICIA offers MentivisOS ICIA, a free lifelong platform to learn AI with a personalized learning path.
Discover MentivisOS ICIA