Except that in some cases (example: GDPR) there is a legal obligation to explain rights.
One such rights is the right to be forgotten (i.e. you can remove your account)
One such rights is the right to be forgotten (i.e. you can remove your account)
Actually. No. Even in 2017 it was clear that we had to legislate against fuckery.
That is why art. 12 imposes an affirmative duty to facilitate the exercise of rights ("the controller shall facilitate the exercise of data subject rights").
So "forgetting to tell your chatbot to inform people" could have been an oversight. But actively telling the chatbot not to tell people their rights is, unsurprisingly, illegal.
Honestly. If you are a global company in 2026 and you have not yet managed the edge cases of customer deletion, you need to get your head inspected.
IAAL, but this is not legal advice.
My interpretation of this text is that when the subject chooses to exercise their rights, the controller must facilitate them. I don't think it means the controller has an active duty to remind the subject that they have those rights.
> But actively telling the chatbot not to tell people their rights is, unsurprisingly, illegal.
Has this been adjudicated? If not, I don't think that's conclusive. Something is illegal when a court says it is, or when legislation makes it unambiguously clear.
It's important to be careful to distinguish what is from what you think it should be.