Section 1
Transparency and modality
Article 12
Transparent information, communications and methods for exercising the rights of the interested party
1. The data controller shall take appropriate measures to provide the interested party with all the information referred to in Articles 13 and 14 and the communications referred to in Articles 15 to 22 and Article 34 relating to the processing in a concise, transparent and intelligible form. and easily accessible, with simple and clear language, particularly in the case of information specifically intended for minors. The information is provided in writing or by other means, including, where appropriate, by electronic means. If requested by the interested party, the information may be provided orally, provided that the identity of the interested party is proven by other means.
2. The data controller shall facilitate the exercise of the data subject's rights pursuant to Articles 15 to 22. In the cases referred to in Article 11, paragraph 2, the data controller may not refuse to comply with the data subject's request. in order to exercise his rights pursuant to articles 15 to 22, unless the data controller demonstrates that he is unable to identify the interested party.
3. The data controller shall provide the interested party with information relating to the action taken regarding a request pursuant to articles 15 to 22 without unjustified delay and, in any case, at the latest within one month of receiving the request. This deadline may be extended by two months if necessary, taking into account the complexity and number of requests. The data controller informs the interested party of this extension, and of the reasons for the delay, within one month of receiving the request. If the interested party submits the request by electronic means, the information is provided, where possible, by electronic means, unless otherwise indicated by the interested party.
4. If the data controller does not comply with the data subject's request, he/she will inform the data subject without delay, and at the latest within one month of receiving the request, of the reasons for non-compliance and of the possibility of lodging a complaint with a supervisory authority. control and to propose judicial appeal.
5. The information provided pursuant to Articles 13 and 14 and any communications and actions taken pursuant to Articles 15 to 22 and Article 34 are free of charge. If the requests of the interested party are manifestly unfounded or excessive, in particular due to their repetitive nature, the data controller may:
a) charge a reasonable fee taking into account the administrative costs incurred in providing the information or communication or taking the requested action; or
b) refuse to comply with the request. The burden of demonstrating the manifestly unfounded or excessive nature of the request lies with the data controller.
6. Without prejudice to Article 11, if the data controller has reasonable doubts about the identity of the natural person making the request referred to in Articles 15 to 21, he may request further information necessary to confirm the identity of the interested party .
7. The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardized icons to give, in an easily visible, intelligible and clearly legible manner, an overview of the intended processing. If presented electronically, the icons are machine-readable.
8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 to establish the information to be presented in the form of an icon and the procedures for providing standardized icons.
Section 2
Information and access to personal data
Article 13
Information to be provided if personal data is collected from the interested party
1. In the event of collection of data concerning him or her from the interested party, the data controller shall provide the interested party with the following information at the time the personal data are obtained:
a) the identity and contact details of the data controller and, where applicable, of his representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the processing for which the personal data are intended as well as the legal basis of the processing;
d) if the processing is based on Article 6, paragraph 1, letter f), the legitimate interests pursued by the data controller or by third parties;
e) any recipients or any categories of recipients of the personal data;
f) where applicable, the intention of the data controller to transfer personal data to a third country or to an international organization and the existence or absence of an adequacy decision by the Commission or, in the case of transfers referred to in Article 46 or 47, or Article 49, second paragraph, the reference to the appropriate or appropriate guarantees and the means to obtain a copy of such data or the place where they have been made available.
2. In addition to the information referred to in paragraph 1, when the personal data are obtained, the data controller shall provide the interested party with the following additional information necessary to guarantee correct and transparent processing:
a) the period of retention of the personal data or, if this is not possible, the criteria used to determine this period;
b) the existence of the right of the interested party to ask the data controller for access to personal data and the rectification or cancellation of the same or the limitation of the processing concerning him or her or to oppose their processing, in addition to the right to portability some data;
c) if the processing is based on Article 6, paragraph 1, letter a), or on Article 9, paragraph 2, letter a), the existence of the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on consent given before revocation;
d) the right to lodge a complaint with a supervisory authority;
e) whether the communication of personal data is a legal or contractual obligation or a necessary requirement for the conclusion of a contract, and whether the interested party has the obligation to provide the personal data as well as the possible consequences of failure to communicate such data;
f) the existence of an automated decision-making process, including profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party.
3. If the data controller intends to further process the personal data for a purpose other than that for which they were collected, before such further processing it shall provide the interested party with information regarding this different purpose and any further relevant information referred to in paragraph 2.
4. Paragraphs 1, 2 and 3 shall not apply if and to the extent that the data subject already has the information.
Article 14
Information to be provided if the personal data have not been obtained from the interested party
1. If the data have not been obtained from the interested party, the data controller shall provide the interested party with the following information:
a) the identity and contact details of the data controller and, where applicable, of his representative;
b) the contact details of the data protection officer, where applicable;
c) the purposes of the processing for which the personal data are intended as well as the legal basis of the processing;
d) the categories of personal data in question;
e) any recipients or any categories of recipients of the personal data;
f) where applicable, the intention of the data controller to transfer personal data to a recipient in a third country or to an international organization and the existence or absence of an adequacy decision by the Commission or, in the case of transfers of referred to in Article 46 or 47, or in Article 49, second paragraph, the reference to adequate or appropriate guarantees and the means to obtain a copy of such data or the place where they have been made available.
2. In addition to the information referred to in paragraph 1, the data controller shall provide the interested party with the following information necessary to guarantee correct and transparent processing towards the interested party:
a) the period of retention of the personal data or, if this is not possible, the criteria used to determine this period;
b) if the processing is based on Article 6, paragraph 1, letter f), the legitimate interests pursued by the data controller or by third parties;
c) the existence of the right of the interested party to ask the data controller for access to personal data and the rectification or cancellation of the same or the limitation of the processing of personal data concerning him and to oppose their processing, in addition to the right to data portability;
d) if the processing is based on Article 6, paragraph 1, letter a), or on Article 9, paragraph 2, letter a), the existence of the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on consent before revocation;
e) the right to lodge a complaint with a supervisory authority;
f) the source from which the personal data originates and, if applicable, whether the data comes from publicly accessible sources;
g) the existence of an automated decision-making process, including profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party.
3. The data controller provides the information referred to in paragraphs 1 and 2:
a) within a reasonable period of obtaining the personal data, but at the latest within one month, taking into account the specific circumstances in which the personal data are processed;
b) in the event that the personal data are intended for communication with the interested party, at the latest at the time of the first communication to the interested party; or
c) if communication to another recipient is envisaged, no later than the first communication of the personal data.
4. If the data controller intends to further process the personal data for a purpose other than that for which they were obtained, before such further processing it shall provide the interested party with information regarding this different purpose and any relevant information referred to in the paragraph 2.
5. Paragraphs 1 to 4 do not apply if and to the extent that:
a) the interested party already has the information;
b) communicating such information is impossible or would involve a disproportionate effort; in particular for processing for archiving purposes in the public interest, scientific or historical research or statistical purposes, without prejudice to the conditions and guarantees referred to in Article 89, paragraph 1, or to the extent that the obligation referred to in paragraph 1 of this article risks making it impossible or seriously jeopardizing the achievement of the purposes of such processing. In such cases, the data controller adopts appropriate measures to protect the rights, freedoms and legitimate interests of the interested party, including by making the information public;
c) the obtaining or communication is expressly provided for by Union or Member State law to which the data controller is subject and which provides for appropriate measures to protect the legitimate interests of the interested party; or
(d) where the personal data must remain confidential in accordance with an obligation of professional secrecy governed by Union or Member State law, including a statutory obligation of secrecy.
Article 15
Right of access of the interested party
1. The interested party has the right to obtain confirmation from the data controller as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data in question;
c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organisations;
d) when possible, the expected retention period of personal data or, if this is not possible, the criteria used to determine this period;
e) the existence of the right of the interested party to ask the data controller to rectify or delete personal data or to limit the processing of personal data concerning him or to oppose their processing;
f) the right to lodge a complaint with a supervisory authority;
g) if the data are not collected from the interested party, all available information on their origin;
h) the existence of an automated decision-making process, including profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party.
2. If personal data are transferred to a third country or to an international organisation, the interested party has the right to be informed of the existence of adequate guarantees pursuant to Article 46 relating to the transfer.
3. The data controller provides a copy of the personal data being processed. In case of further copies requested by the interested party, the data controller may charge a reasonable fee based on administrative costs. If the interested party submits the request by electronic means, and unless the interested party indicates otherwise, the information is provided in a commonly used electronic format.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
Section 3
Rectification and cancellation
Article 16
Right of rectification
The interested party has the right to obtain from the data controller the rectification of inaccurate personal data concerning him without unjustified delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.
Article 17
Right to erasure (“right to be forgotten”)
1. The interested party has the right to obtain from the data controller the deletion of personal data concerning him or her without unjustified delay and the data controller has the obligation to delete the personal data without unjustified delay, if one of the following reasons exists:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the interested party withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and if there is no other legal basis for the processing ;
c) the interested party objects to the processing pursuant to Article 21, paragraph 1, and there is no overriding legitimate reason to proceed with the processing, or objects to the processing pursuant to Article 21, paragraph 2;
d) the personal data have been processed unlawfully;
e) the personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject;
f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. The data controller, if he has made personal data public and is obliged, pursuant to paragraph 1, to delete them, taking into account the available technology and implementation costs, adopts reasonable measures, including technical ones, to inform the data controllers who are processing the personal data of the interested party's request to delete any link, copy or reproduction of his/her personal data.
3. Paragraphs 1 and 2 do not apply to the extent that processing is necessary:
a) for the exercise of the right to freedom of expression and information;
b) for the fulfillment of a legal obligation which requires processing provided for by Union or Member State law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of public authority of which the data controller is vested;
(c) for reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3);
(d) for archiving purposes in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1), to the extent that the right referred to in paragraph 1 is likely to render impossible or seriously undermine the achievement of the objectives of such processing; or
e) for the establishment, exercise or defense of a right in court.
Article 18
Right to restriction of processing
1. The interested party has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs:
a) the interested party disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
b) the processing is unlawful and the interested party opposes the deletion of the personal data and instead requests that their use be limited;
c) although the data controller no longer needs them for the purposes of the processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court;
d) the interested party has objected to the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
2. If processing is limited pursuant to paragraph 1, such personal data shall be processed, except for storage, only with the consent of the interested party or for the establishment, exercise or defense of legal claims. or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. The interested party who has obtained the limitation of processing pursuant to paragraph 1 shall be informed by the data controller before said limitation is revoked.
Article 19
Obligation to notify in case of rectification or deletion of personal data or limitation of processing
The data controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectifications or cancellations or limitations of processing carried out pursuant to Article 16, Article 17, paragraph 1, and Article 18, unless this proves impossible or involves a disproportionate effort. The data controller communicates these recipients to the interested party if the interested party requests it.
Article 20
Right to data portability
1. The interested party has the right to receive the personal data concerning him or her provided to a data controller in a structured, commonly used and machine-readable format and has the right to transmit such data to another data controller without impediments on the part of the data controller to whom it was provided if:
a) the processing is based on consent pursuant to Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), or on a contract pursuant to Article 6, paragraph 1, letter b); And
b) the processing is carried out by automated means.
2. When exercising his or her rights regarding data portability pursuant to paragraph 1, the interested party shall have the right to obtain the direct transmission of personal data from one data controller to another, if technically feasible.
3. The exercise of the right referred to in paragraph 1 of this article is without prejudice to Article 17. This right does not apply to processing necessary for the execution of a task of public interest or connected to the exercise of public powers referred to the data controller is vested.
4. The right referred to in paragraph 1 must not adversely affect the rights and freedoms of others.
Section 4
Right to object and automated decision-making relating to natural persons
Article 21
Right of opposition
1. The interested party has the right to object at any time, for reasons connected to his particular situation, to the processing of personal data concerning him pursuant to Article 6, paragraph 1, letters e) or f), including profiling on basis of these provisions. The data controller shall refrain from further processing the personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing which prevail over the interests, rights and freedoms of the interested party or for the assessment, exercise or the defense of a right in court.
2. If personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is connected to such marketing direct.
3. If the interested party objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.
4. The right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information at the latest at the time of the first communication with the data subject.
5. In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using specific techniques.
6. If personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89, paragraph 1, the interested party, for reasons related to his particular situation, has the right to object to the processing of personal data concerning him, unless the processing is necessary for the performance of a task in the public interest.
Article 22
Automated decision-making relating to natural persons, including profiling
1. The interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or which similarly significantly affects him or her.
2. Paragraph 1 shall not apply where the decision:
a) is necessary for the conclusion or execution of a contract between the interested party and a data controller;
b) is authorized by Union or Member State law to which the data controller is subject, which also specifies adequate measures to protect the rights, freedoms and legitimate interests of the interested party;
c) is based on the explicit consent of the interested party.
3. In the cases referred to in paragraph 2, letters a) and c), the data controller shall implement appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, at least the right to obtain human intervention on the part of the data controller of the treatment, to express one's opinion and to contest the decision.
4. The decisions referred to in paragraph 2 shall not be based on the special categories of personal data referred to in Article 9(1), unless points (a) or (g) of Article 9(2) apply. and there are no adequate measures in place to protect the rights, freedoms and legitimate interests of the interested party.
