# Standards — AI Data Subject Rights

## Primary Legislation
- **GDPR Arts. 15-22**: Full suite of data subject rights applicable to AI processing.
- **GDPR Art. 12**: Modalities for exercising rights — transparent, intelligible, easily accessible, within one month.
- **AI Act Art. 86**: Right to explanation for high-risk AI decisions.
- **EDPB Guidelines 06/2020**: Automated decision-making including profiling — explanation requirements.
- **EDPB Guidelines 04/2025**: AI-specific rights exercise — training data access, erasure from models.
- **EDPB ChatGPT Taskforce (2024)**: Rights exercise for LLM processing.

## Enforcement
- **Austrian DPA v. CRIF (2023)**: Art. 15(1)(h) violation — no meaningful logic explanation for AI scoring.
- **Garante v. OpenAI (2023)**: Required data subject rights mechanisms for AI training and outputs.
- **Polish DPA (ZSPR.421.25.2019, 2019)**: Fine for automated scoring without Art. 14 information.