The tiles on this page show the rights and interests that controllers can rely on for the processing of personal data. Furthermore, in addition to the rights and interests of the data subject and the controller, the rights and interests of third parties may also be affected by the data processing.

When it comes to the question of who the GDPR protects, a consistent approach is not apparent. According to its wording, it protects "data subjects" (57 mentions related to rights/freedoms/interests), "natural persons" (33 mentions), "third parties" or "other persons" (18 mentions) and rights without further designation (6 mentions). It follows that the GDPR does not only protect "data subjects".

This also follows without further ado from the legal fact that the rights of the data subject are not absolute rights:

German Federal Constitutional Court: “The guarantee of this right to ‘informational self-determination’ is not entirely unrestricted. Individuals have no right in the sense of absolute, unrestricted control over ‘their’ data” [Judgement of 15 December 1983 – 1 BvR 209/83 et al -, para. 150].

 

European Court of Justice: “The right to the protection of personal data is not an absolute right” [Judgement of 24 November 2019 - C-507/17 -, para. 60].

The rights of the data subject are restricted by public interests [see Tile ...] and the rights of others. This is also established in the case law of the highest courts:

German Federal Constitutional Court: The right to informational self-determination “must be balanced against the freedom to gather, process and use information for one’s own purposes, including changing purposes” [Decision of 6 November 2019 - 1 BvR 16/13 -, para. 87].

 

European Court of Justice: “The right to the protection of personal data […] must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality” [Judgement of 24 November 2019 - C-507/17 -, para. 60].

Accordingly, the GDPR not only protects the rights and freedoms of data subjects, but also the rights and freedoms of the controller and the rights and freedoms of other persons. The regulation of the GDPR is multi-dimensional in terms of fundamental rights:

The data subject’s rights that are regularly considered to be affected are the right to private life [Tile I.14] and right to data protection [Tile I.15]. However, if fundamental rights are in dispute on the side of the data subject in any data processing, fundamental rights must also intervene in favour of the controller. The obligations and prohibitions imposed by the GDPR on the controller when processing personal data affect at least the controller's general freedom of action, which is protected by fundamental rights. At least in the relationship between private parties, there are accordingly interests protected by fundamental rights on both sides. This comes very close to a unmittelbare Drittwirkung (= horizontal effect) of fundamental rights.

German Federal Constitutional Court: “The requirements and burden of justification applicable to the relationships between private actors are contingent upon a balancing to assess the need for protection arising between private actors in the various case constellations, which are frequently multipolar” [Decision of 6 November 2019 - 1 BvR 16/13 -, para. 87].

The GDPR does not sufficiently recognise the multi-dimensionality of data processing under fundamental rights. However, by explicitly referring to the rights and freedoms of  "other persons" and to the rights and freedoms of "natural persons", the GDPR takes into account the fact that any data processing by non-governmental bodies is potentially a claim on fundamental rights. This is confirmed by Rec. 4 (2) GDPR: 

"The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality."

In addition, the fundamental rights of the Charter of Fundamental Rights must be used to interpret the term "rights and freedoms" and Art. 52 I CFR must be used to weigh up the fundamental rights (practical concordance). According to this, limitations on the exercise of the rights and freedoms may be made if they "are necessary and genuinely meet objectives of […] the need to protect the rights and freedoms of others”. The tiles on this page show which fundamental rights are at issue on the part of controller and other persons.