Data subject rights

How the rights are exercised

The controller provides information and communications about processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language art. 12(1), and facilitates the exercise of the rights art. 12(2).

On receiving a request, the controller responds without undue delay and in any event within one month. The period may be extended by two months where necessary, taking into account the complexity and number of requests, and the data subject must be told of the extension and the reasons for it within the first month art. 12(3). If the controller does not act on the request, it explains why within the same one-month period and informs the data subject of the possibility of lodging a complaint with the National Centre for Personal Data Protection or bringing an action before a court art. 12(4).

Responses are free of charge. For manifestly unfounded or excessive requests, the controller may charge a reasonable fee or refuse to act, but it must demonstrate that the request is of that kind art. 12(5). Where it has reasonable doubts about the identity of the person making the request, the controller may ask for additional information to confirm it art. 12(6).

The right to be informed

When it collects data from the data subject, the controller informs him or her at the time of collection of its identity, the purposes and legal basis of the processing, the recipients and the rights he or she has art. 13(1), art. 13(2). Where the data comes from another source, the information is given within a reasonable period of no more than one month art. 14(3)(a), or earlier in the cases in art. 14(3)(b) and art. 14(3)(c). The obligation does not apply, for example, where the person already has the information art. 13(4), art. 14(5).

Rights over one’s own data

• Access. The data subject may find out whether his or her data is being processed and obtain access to it and to information about the processing art. 15(1), including a copy of the data art. 15(3).
• Rectification. Inaccurate data is rectified without undue delay, and incomplete data is completed, taking into account the purposes of the processing art. 16.
• Erasure. Data is erased in the cases set out in the Law, for example where it is no longer necessary, where consent has been withdrawn and there is no other legal basis, or where it has been processed unlawfully art. 17(1). Erasure does not apply, among other cases, where processing is necessary for a legal obligation or for the establishment, exercise or defence of a right art. 17(3).
• Restriction. The data subject may obtain restriction of processing, for example while the accuracy of contested data is being verified art. 18(1).
• Portability. Data that the data subject has provided, processed by automated means on the basis of consent or a contract, is given to him or her in a structured, commonly used and machine-readable format art. 20(1).

The controller communicates any rectification, erasure or restriction to each recipient to whom it has disclosed the data, unless this proves impossible or involves disproportionate effort art. 19.

Objection and automated decisions

The data subject may object, on personal grounds, to processing based on a public interest or a legitimate interest. The controller stops the processing unless it demonstrates compelling legitimate grounds that override the data subject’s interests, or the defence of a right art. 21(1). For direct marketing, the data subject may object at any time, and once he or she does, the data is no longer processed for that purpose art. 21(2), art. 21(3). The right to object is explicitly brought to the data subject’s attention at the latest at the first communication art. 21(4). For online stores, we explain consent for cookies, pixels and newsletters under data protection for online stores.

The data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects concerning him or her or similarly significantly affects him or her art. 22(1). The exceptions are limited art. 22(2), and where the decision rests on a contract or on explicit consent, the person keeps at least the right to obtain human intervention, to express his or her point of view and to contest the decision art. 22(3).

Restrictions

These rights may be restricted only by law, in a way that respects the essence of fundamental rights and as a necessary and proportionate measure for purposes such as national security or the prevention of criminal offences art. 23(1).