Can data protection rights of a subject be voluntarily waived?

Question

Presumably not on protrusion by a service provider as a condition of their service. But what if someone writes to someone super busy whom they admire and says “look I really respect you and don’t want to get on your nerves so I don’t intend to compel you to prepare a SAR response for me but if it happened to be really convenient and you felt like doing it then it would be really helpful to me to have this information. Just don’t feel compelled to comply with this request as a statutory obligation.”

Would that be a valid waiver of one’s subject access entitlement?

Answer 1

GDPR rights and obligations cover different things:

• A duty of the data processor towards the government of the country where they operate to present certain documentation, and to implement technical and organizational measures to protect data. These would be audited by government agencies, not the individual customer. A single data subject cannot waive them.
• A duty of the data processor to process and store personal data only with a legal justification. User consent is one possible justification, if it is informed, revokable, etc. So a single data subject can waive a "ban" on storing his or her data in a database along with all the other users who waived that "ban," but the duties towards the government regarding that data would still apply.
• A duty of the data processor to respond to an Article 15 request by the data subject in a certain way and timeframe. If a data subject writes a letter to the data processor and explicitly states that the letter is not an Article 15 request, then Article 15 does not apply. The data subject would of course have the right to make an Article 15 request at a later time.

Answer 2

GDPR data subject rights cannot be waived. Data protection is a fundamental right, based on Art 8(1) of the Charter and Art 16(1) TFEU. However, GDPR balances this right to data protection against other rights, and explains modalities around how this right is guaranteed.

The GDPR does allow data subjects to agree to processing activities that might be against their interests, by giving consent. However, consent must be freely given, specific, and informed, a high bar intended to protect data subjects. Explicit consent can be used to authorize certain activities that would otherwise be prohibited, e.g. processing health data, or transferring data into countries without an adequate level of data protection. “Do whatever you want” carte blanche permission cannot be valid GDPR consent, because it is not sufficiently specific.

The data subject rights in Arts 12 to 22 GDPR cannot be waived. The rights are necessary to hold data controllers accountable. These rights already include limitations to protect data controllers from data subjects that exercise these rights abusively. There is no mechanism that would make it possible to make contracts requiring the non-exercise of these rights, that would go against their purpose.

However, data subjects are not required to invoke the Art 12–22 data subject rights. They can voluntarily not exercise them. This is in contrast to the fundamental GDPR principles like lawfulness or accountability, that data controllers must always fulfil, regardless of whether a data subject explicitly invokes them.

You suggested this phrasing in a request for information:

I don’t intend to compel you to prepare a SAR response for me but if it happened to be really convenient and you felt like doing it then it would be really helpful to me to have this information.

That does not sound like a valid Art 15 data subject access request, because it clearly does not try to invoke the right to access. But it's not a general waiver of that right – the right to access could still be properly invoked at any later time.