Rights of Data Subjects

The data subject has the following rights:

  • Right of information. When demanding information about processing of his data, the data subject has to do it in writing and with a proof of his identity. The controller has to give such information in writing within eight weeks of the request or explain why he is not able to provide such information.
  • Right to rectification and erasure. Every controller must rectify or erase data that are incorrect or have been processed contrary to the provisions of the Protection of Personal Data Act, as soon the incorrectness of the data or the inadmissibility of the processing becomes known to him, or upon the request of the data subject. The data must be rectified or erased within eight weeks of the request.
  • Right to object. When the use of data is not authorized by law, the data subject has the right to object to the use of data because of an infringement of an overriding interest in secrecy deserving protection arising from his special situation. If the requirements are met, the controller must erase the data relating to the data subject within eight weeks from the request and must refrain from transmitting the data.
  • Right to restrict processing. The data subjects’ personal data can be held by the controller and used only for limited purposes in the case the data is: not up-to-date; the processing is unlawful; he controller needs it to establish, defend or exercise legal rights; verification of overriding grounds is pending in the context of an erasure request.
  • Right to data portability.
  • Right to withdraw consent. Data subjects can revoke their consent at any time in any form, thus making further data processing illegal.
  • Right to object to marketing.
  • Right to complain to the relevant data protection authority.