- What are the rights of individuals whose data is being processed?
The rights of natural persons stemming from the Law on Personal Data Protection are the following:
The Right to Give or Not to Give Consent to Personal Data Processing – Every natural person has a right to give or not to give consent to personal data processing to the controller, if the controller is not conducting the processing according to his/her legal mandate. The natural person has a right to give consent through a proxy, and can also revoke his/her consent. In order for a natural person to give consent, the controller is obliged to provide information on his/her identity and other information outlined in Article 15 of the Law on Personal Data Protection.
The Right to Information on Personal Data Processing – The data subject has the right to request to be fully and truthfully informed by the controller about whether the controller is processing data on him/her, which data is being processed, to what purpose the aforementioned data is processed and on what legal ground it is being processed, and, who the data is collected from, that is, who the source of data is; in what filing system the data is included, who the recipients of the aforementioned data are, which data is being used, to what purposes and on what legal grounds; to whom the data is transferred, to what purposes and on what legal grounds; as well as other issues outlined in Article 19 of the Law on Personal Data Protection.
The Right to Insight – The data subject is entitled to request from the controller to have insight into data concerning him/her. The right to insight into data concerning him/her includes the right to see, read and hear the data and the right to take notes.
The Right to Copy – The data subject is entitled to request from the controller a copy of the data concerning him/her, while the necessary costs of making and transferring of the copy of data shall be borne by the data subject.
The Rights of Data Subject Regarding Insight Performed – The data subject has the right to request from the controller the correction, amendment, updating, and erasure of data, as well as the termination and temporary recess of processing, if the conditions outlined in Article 22 of the Law on Personal Data Protection have been met.
-In what manner is it possible to request the realization of rights related to personal data processing?
The request for information, insight and copy is filed in writing to the controller by the data subject whose data is being processed, except when oral submission is also acceptable for the controller, particularly for reasons of efficiency and economy. The request for the realization of right regarding the performed insight is filed to the controller solely in writing.
-When is an appeal concerning personal data protection filed to the Commissioner?
The data subject submitting an appeal to the Commissioner regarding personal data processing can do so within 15 days from receiving the ruling by which the request is denied or rejected. Moreover, the data subject may submit an appeal even upon the expiry of the prescribed time limit for deliberation and acting – so-called, the failure of the authorities to act (THE PRESCRIBED TIME LIMITS FOR THE CONTROLLER TO ACT: 15 days from the day of submission of the request for information on personal data processing, or 30 days from the day of submission of the request for insight or for the copy of the documents containing personal data, or 15 days from the day of submission of the request concerning the performed insight).
Administrative dispute may be initiated against the Commissioner’s ruling.
