Information on the right to require access to personal data of the data subject from the relevant authority, correction, erasure or restriction of processing thereof
The data subject has a right to obtain confirmation from the relevant authority of personal data concerning them which are being processed, and if this is the case, to obtain access to such personal data and information about
a) The purpose of the personal data processing and the legal basis of the personal data processing,
b) The categories of the processed personal data,
c) The recipient or categories of recipients who were or should be provided with the personal data, in particular the recipients in a third country or international organisation,
d) The period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period,
e) The existence of the right to request from the relevant authority rectification or erasure of personal data or restriction of processing of personal data as well as the right to object to the personal data processing,
f) The Office contact details,
g) The existence of the right to file the proceedings under Art. 100,
h) The source of the personal data, if available.
Natural person should have the right of access to personal data which have been collected concerning him/her, and to exercise that right easily, in order to be aware of, and verify, the lawfulness of the processing. Every data subject shall have the right to be aware and to be informed in particular about the purposes of data processing, categories of the personal data concerned and on the period for which the data will be processed as well as the personal data recipients, etc. To comply with this right, it is sufficient if the data subject has access to full summary of the data concerned in an intelligible form, i.e. the form enabling the data subject to be informed about the data concerned and to exercise the rights granted by this Act.
The relevant authority may fully or partially restrict the access to their personal data, in particular within the extent and for the period as necessary and reasonable with respect to the rights and legitimate interests of the data subject in a democratic society, to prevent obstruction of the official or judicial detection, investigation or proceedings, to prevent threats to the performance of tasks for the purposes of criminal proceedings, to protect public security or national security or to protect the rights and freedoms of others. The relevant authority should assess, through specific and individual review of every case, whether or not the right of access should be partially or fully restricted.
The data subject should be notified of the restriction of access in principle in writing, including the fact or law reasons such decision is based on.
The data subject also has the right to rectification of any incorrect personal data concerning him/her, as well as the right to erasure if the processing of such data infringes the law. However, the content of witness testimony, for example, should not be affected by the right to rectification.
The data subject has the right to restriction of processing, if the accuracy of the personal data is contested by the data subject and it is not possible to determine their correctness or incorrectness or if the personal data shall be stored for the substantiation purposes. Processing should be restricted instead of erasure in mainly if, in a particular case, it can be reasonably considered that the erasure could impact the data subject's legitimate interests. In such case, the restricted data should be only processed for the purposes preventing the erasure thereof. Methods by which to restrict the processing of personal data could include, inter alia, moving the selected data to another processing system, for example for archiving purposes or making the selected personal data unavailable. In the automated information systems, the restriction of processing should in principle be ensured by technical means. The fact that the processing of personal data is restricted should be clearly indicated in the system so that it was clear that the personal data processing is restricted. The recipients who were provided the data and the relevant authorities the incorrect data originate from should be notified of such rectification or erasure of personal data or restriction. The relevant authorities should also refrain from further distribution of such data.
Please feel free to ask for more information through our Data Protection Officers.