Many GDPR provisions refer to the rights and freedoms of "natural persons". At first glance, this only refers to "data subjects". On closer inspection, however, it becomes clear that other "natural persons" must also be meant.

The definition in Art. 4 No. 7 GDPR shows that "natural persons" can also be "controllers". Insofar as the GDPR refers to the rights and freedoms of "natural persons", this may also refer to the rights and freedoms of natural persons who process personal data and who therefore are “controllers”. Example: The researcher who processes health data exercises his freedom of the sciences.

Furthermore, the definition in Art. 4 No. 10 GDPR shows that “natural persons” can also be "third parties".

Finally, other third persons (who are neither "controllers" nor "third parties") may also be adversely affected by an application of the GDPR: e.g. content providers who are deprived of a distribution medium when their contribution is delisted from a search engine [cf. BVerfG, Order of 6.11.2019 - 1 BvR 276/17 ("Right to be Forgotten II") -, para. 108]. Thus, insofar as the GDPR refers to the rights and freedoms of "natural persons", the rights and freedoms of "third parties" or other third persons may also be meant.

Listed below are the 12 provisions in articles and 24 provisions in recitals of the GDPR that relate to the rights and freedoms of "natural persons" (i.e. also to the rights and freedoms of "controllers" and "other persons"):

Articles: 1 I/II, 24 I, 25 I, 27 II a, 32 I, 33 I, 34 I, 35 I, 51 I, 57 I c and 70 I h GDPR.

 

Recitals: 2 (1), 3, 9 (1), 10 (1)/(2), 53 (3), 54 (2), 74 (3), 75, 77 (2), 78 (1), 80 (1), 84 (1), 85 (2), 86 (1), 89 (3), 94 (1)/(5), 98 (2), 113 (2), 116 (1), 154 (6), 166 (1) and 173 (1) GDPR.

The GDPR does not explicitly state which "rights and freedoms" are meant [see Tiles R]. Which "rights and freedoms" are protected is therefore highly controversial and unclear.