Rights of the Data Subject
The controller must ensure that the rights of the data subject prescribed by the GDPR are respected. The data subject has the following rights:
the right to be informed about the processing of personal data
the right to access the data
the right to rectify the data
the right to the erasure of the data
the right to object processing
the right to restrict processing
the right to transmit data to another controller
the right not to be subject to automated decision making.
The controller shall upon request provide the data subject with information about the actions taken, without undue delay and within one month after receiving the request. If needed, the time limit may be extended by a maximum of two months, taking into consideration the complexity and number of requests. The controller shall inform the data subject of this possible extension within one month after receiving the request, including the reason for the delay.
Right to be informed
The controller shall ensure that the data subject receives information on the processing of its personal data. The data subject must be informed when personal data is collected from the data subject directly, and when data obtained from sources other than the data subject itself is disclosed for the first time. The controller shall take necessary actions to provide the data subject with all information regarding the processing in accordance with the GDPR. The information must be provided in a way that is concise, transparent, intelligible, easily accessible and in a clear and plain language, especially if the information is intended for a child. The data subject has the right to be informed about all the collected data. It is not enough only to mention, e.g., on the company’s website, that personal data is being collected. Read more about the obligation to inform in section [Information Obligation of the Controller].
Right to access the data
In principle, the data subject has the right to obtain confirmation from the controller on whether their personal data is processed or not. If data is processed, the data subjects have the right to access the personal data concerning them, as well as information on the purposes of the processing, to whom the data is disclosed and the storage periods of the personal data.
The controller must provide the data subjects with a copy of their personal data. The data shall be given without undue delay and in an understandable form. If the data subject requests several copies, the controller may charge a reasonable fee corresponding to the administrative costs of the operation. If the data subject requests to obtain the data electronically, the data shall be provided in a generally used electronic form, unless otherwise requested. The right of inspection is, in principle, free of charge.
Right to rectification and erasure
The data subject has the right to have inaccurate, outdated, and incorrect personal data rectified, without undue delay. With respect to the purposes for processing data, the data subject is entitled to have the inadequate data rectified, for instance by providing the additional information needed.
The data subject also has the right to have personal data erased by the controller without undue delay, if:
the controller no longer needs the data for the original purpose of use,
the data subject withdraws their consent to the processing of personal data, and there is no other legal ground for the processing,
the data subject objects to the processing, and there are no legitimate grounds for the processing,
the data subject objects to the processing for direct marketing purposes,
the data has been processed unlawfully,
the data has to be deleted on grounds of legislation, or
the data has been collected with the consent of a guardian in connection with offering information society services to a child.
The personal data doesn't have to be deleted, if they are justifiably necessary for specific purposes, such as complying with a legal obligation, public interest such as archiving, research or statistical purposes, or guaranteeing the freedom of expression and information.
Other rights
For specific personal reasons, the data subject also has the right to object to the processing of personal data, and to request that the information is not processed at all. If the request concerns processing for direct marketing purposes, no further justification for the request is needed. Objections are also possible if the controller processes data on grounds of public interest or the use of public authority, or on basis of a legitimate interest (profiling or access control). In connection with the objection, the data subject must specify the situations, based on which the data subject objects to the processing. The controller may refuse to realize the request only on grounds provided by law.
Moreover, data subjects have the right to restricted processing of their personal data, if the accuracy of the information is disputed or if the processing is unlawful, and the data subject demands the controller to restrict the processing instead of erasing the data. The controller must notify the data subject before such processing restriction is lifted.
The data subject has the right to obtain, in a commonly used and machine-readable format, data relating to him or her and supplied by him or her, the processing of which is carried out automatically and is based on a contract or on consent, and to have them transmitted to another controller from one information system to another. However, the right to data portability does not apply to processing of such data, which is necessary for the performance of a task carried out for the public interest or the exercise of an official authority belonging to the controller.
In some situations, the data subject has the right not to be subject to a decision that is based solely on automated processing, such as profiling, that has legal or similarly significant effects on the data subject. Such effects would include, for example, automatic refusal of a credit application or electronic recruiting without any form of human intervention.