Restriction of data subject´s rights (to refuse a request)

When is it possible to restrict data subject´s rights?

The controller is entitled not to grant the request of data subject only in case the data subject exercises his right to:

• rectification or erasure of inaccurate, incomplete or not updated personal data, which constitute the subject of the processing and
• erasure of his/her personal data, if the purpose of their processing was fulfilled.

However, the rights of data subject may be restricted only if such restriction results from a special Act or if exercising of this right would infringe the protection of data subject himself or infringe the rights and freedoms of others.

Example: The employer (i.e. the controller) is obliged to follow e.g. the Act No. 400/2009 Coll. on Civil Service while managing human resourcing and payroll. Pursuant to Section 73 Paragraph 4 of this Act, after the termination of civil service employment relationship service office preserves personal record of the civil service employer for the duration of 50 years and therefore the employer (i.e. the controller) cannot satisfy the request of the data subject and is obliged to restrict his rights.

What obligation has to be fulfilled for restricting data subject´s rights?

The controller is obliged to notify in writing the data subject and the Office about the restrictions of data subject´s rights without undue delay.

What shall I do if I have suspicion that my rights as the data subject were unlawfully restricted?

The data subject is entitled to address the Office with the notification initiating a proceeding on violation of his right, appendix of which shall be a letter by which he has exercised his right and the letter informing him on restrictions of his rights.