Study smarter with Fiveable
Get study guides, practice questions, and cheatsheets for all your subjects. Join 500,000+ students with a 96% pass rate.
Digital privacy rights form the backbone of every major data protection framework you'll encounter on the exam—from GDPR to CCPA to emerging AI regulations. When you're tested on these concepts, you're not just being asked to list rights; you're being evaluated on your understanding of power dynamics between individuals and organizations, the ethical principles that justify each right, and how these rights work together to create a comprehensive protection system. Think of these rights as tools that operationalize broader ethical concepts like autonomy, transparency, accountability, and informed consent.
Here's the key insight: these rights don't exist in isolation. They form an interconnected system where some rights enable others, some rights limit organizational power, and some rights provide enforcement mechanisms when things go wrong. Don't just memorize the names—know what ethical principle each right protects and when organizations can (and cannot) override individual preferences. That's what separates a passing answer from an excellent one.
These rights address a fundamental power imbalance: organizations know everything about what they're doing with your data, while individuals often know nothing. Transparency rights level the playing field by requiring organizations to share information proactively and on request.
Compare: Right to Be Informed vs. Right to Access—both create transparency, but informed is proactive (organization initiates) while access is reactive (individual requests). FRQs often ask which right applies when: if data hasn't been collected yet, it's informed; if you want to see existing data, it's access.
These rights give individuals active power over their data, not just passive knowledge. The ethical principle here is autonomy—the idea that individuals should control information about themselves.
Compare: Erasure vs. Restriction—erasure permanently deletes data, while restriction temporarily pauses processing. If an FRQ presents a scenario where someone disputes data accuracy but might need that data later for a legal claim, restriction is the appropriate right, not erasure.
This category reflects a newer ethical concern: preventing data lock-in where individuals feel trapped with one service provider because switching means losing their data history. Portability rights promote both individual autonomy and market competition.
These rights address situations where individuals disagree with how organizations want to use their data. The underlying principle is that consent must be freely given, specific, informed, and revocable.
Compare: Right to Object vs. Right to Withdraw Consent—objection applies when processing is based on legitimate interests or public interest, while withdrawal applies when processing is based on consent. Know your legal basis to identify the correct right.
As AI and algorithms increasingly make consequential decisions about people, these rights ensure human oversight and prevent discriminatory outcomes. The ethical concern is that automated systems can embed bias and deny individuals meaningful agency over important life decisions.
Rights without enforcement mechanisms are merely suggestions. These rights create accountability by giving individuals recourse when organizations violate their obligations.
Compare: Individual enforcement (complaints) vs. organizational accountability (data protection officers, impact assessments)—exams often test whether a scenario calls for individual action or systemic organizational safeguards. Complaints are reactive; organizational measures are preventive.
| Concept | Best Examples |
|---|---|
| Transparency/Knowledge | Right to Be Informed, Right to Access |
| Individual Control | Right to Rectification, Right to Erasure, Right to Restrict |
| Data Mobility | Right to Data Portability |
| Consent Management | Right to Withdraw Consent, Right to Object |
| AI/Algorithm Protection | Rights Related to Automated Decision-Making |
| Enforcement | Right to File Complaints |
| Absolute Rights (no exceptions) | Object to Direct Marketing, Withdraw Consent |
| Conditional Rights (exceptions exist) | Erasure, Automated Decision-Making Protection |
Which two rights both create transparency but differ in whether the organization or individual initiates the information flow? Explain when each applies.
A user disputes the accuracy of their data but wants to preserve it for a potential lawsuit. Which right should they exercise, and why is erasure inappropriate here?
Compare the Right to Object and the Right to Withdraw Consent. What determines which right applies in a given scenario?
An insurance company denies coverage based solely on an algorithmic risk score. Which right(s) can the applicant invoke, and what must the company provide in response?
FRQ-style: A social media platform makes it easy to sign up and consent to data processing but requires users to navigate seven screens and call a phone number to withdraw consent. Identify the ethical violation, the specific right implicated, and explain why this design fails to meet legal standards.