RIGHTS OF THE DATA SUBJECTS UNDER THE GENERAL DATA PROTECTION REGULATION

The data subject is any natural person whose personal data are processed, regardless of whether that person is an EU citizen or not. The General Data Protection Regulation[1] regulates several rights of the data subject that can be exercised directly with the controller (the entity that processes his/her personal data).

1.Right of access

• you have the right to obtain from the controller
  • confirmation as to whether or not personal data concerning you are being processed
  • access to the personal data and other information
  • copy of the personal data undergoing processing
  • information of the appropriate safeguards where personal data are transferred to a third country or to an international organisation
• the controller may charge a reasonable fee for any further copies requested
• template: Žiadosť na prístup k osobným údajom
• more information on the right of access to data in Art. 15 of the General Data Protection Regulation
• more information can be found in the Guidelines on data subject rights - Right of access

2.Right to rectification

• you have the right to obtain from the controller the rectification of personal data concerning you, if those are 
  • inaccurate
  • incomplete  
• template: Žiadosť na opravu osobných údajov
• more information on the right to rectification in Art. 16 of the General Data Protection Regulation  

3.Right to erasure (´right to be forgotten´)

• you have the right to obtain from the controller the erasure of personal data concerning you, if one of reasons listed below is met
  • your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
  • you withdraws the consent on which the processing is based
  • you have exercised your right to object and the controller has complied with such request
  • your personal data have been unlawfully processed
  • it is a legal obligation of the controller to erase your personal data in accordance with the Union or Member State law to which the controller is subject
  • your personal data have been collected in relation to the offer of information society services
• Art. 17 (3) provides for exemption from controller´s obligation to erase personal data

• template: Žiadosť na vymazanie osobných údajov
• more information on the right to erasure in Art. 17 of the General Data Protection Regulation  
• more information can be found in the Guidelines on the criteria of the Right to be Forgotten in the search engines cases under the GDPR part 1

4.Right to restriction of processing

• you have the right to obtain from the controller restriction of processing if one of the following applies
  • you contested the accuracy of the personal data
  • you oppose the erasure of the personal data and request the restriction instead in case of unlawful processing
  • the controller no longer needs the personal data, but you require them for the establishment, exercise or defence of legal claims
  • you have exercised your right to object and your personal data are processed on a legal basis such as a public interest or a legitimate interest

• processing is limited to a certain necessary time, which depends on the specific situation, e.g. until the controller verifies the accuracy of the personal data
• template: Žiadosť na obmedzenie spracúvania osobných údajov
• more information on the right to restriction of processing in Art. 18 of the General Data Protection Regulation

5.Right to data portability

• you have the right to obtain your personal data from the controller and transmit them to another controller while fulfilling these conditions
  • the processing is based on consent or on a contract and
  • the processing is carried out by automated means
  • the requested personal data should relate to the data subject and should be provided by that person
  • the exercise of this right should not adversely affect the rights and freedoms of others

• exercising this right you can:
  • receive the personal data concerning you in a structured, commonly used and machine-readable format
  • request the direct transmission of your personal data to another controller

• template: Žiadosť na prenosnosť osobných údajov
• more information on the right to data portability in Art. 20 of the General Data Protection Regulation

• more information can be found in the Guidelines on the right to data portability

6.Right to object

• you have the right to object to the controller in the following cases
  • if your personal data are processed on a legal basis, which is the public interest or a legitimate interest
  • if the profiling is based on the public interest or a legitimate interest

• this right is most frequently exercised in relation with personal data being processed for the purposes of direct marketing
• template: Žiadosť namietať spracúvanie osobných údajov

• more information on the right to object in Art. 21 of the General Data Protection Regulation

7.The right not to be subject to automated individual decision-making, including profiling

• you have the right not to be subject to a decision, which
  • is based solely on automated processing, including profiling and
  • produces legal effects concerning you or similarly significantly affects you
• your right includes:
  • the right to obtain human intervention on the part of the controller
  • the right to express your point of view
  • the right to contest the decision
• exemptions to this right are possible, if the decision is:
  • necessary for entering into or performance of a contract
  • authorised by Union or Member State law
  • based on the data subject´s explicit consent
• template: Žiadosť, aby sa na mňa nevzťahovalo automatizované individuálne rozhodovanie
• more information on automated individual decision-making, including profiling in Art. 22 of the General Data Protection Regulation
• more information can be found in the Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679

8.Right to withdraw consent

• if the controller processes your personal data on the basis of your consent/explicit consent, you have the right to withdraw your consent at any time 
• the withdrawal of your consent shall be as easy as its giving

• more information on consent in Art. 7 of the General Data Protection Regulation
  • more information can be found in the Guidelines 05/2020 on consent under Regulation 2016/679

9.Right to lodge a complaint to initiate the personal data protection proceeding

• As a data subject, you have the right to lodge a complaint to the Office for personal data protection of the Slovak Republic to initiate the personal data protection proceeding.
• You can find more information about the complaint to initiate proceedings in this link and in the section What to do if the controller did not respond or did not comply with your request?

HOW SHOULD YOU PROCEED IN THE EXERCISE OF YOUR RIGHTS?

• You always exercise your rights with the person who processes your personal data (the particular controller).
• If the controller designated a data protection officer, you can also address your request to this person.
• The request can be made in oral, written, electronic form or otherwise submitted (the General Data Protection Regulation does not prescribe a specific form). We recommend using particularly the written or electronic form to be able to prove that you have exercised your right in case any personal data protection proceedings.
• You should prepare your identification data such as number of your contract, ID, username or password, etc. that means any identifier on the basis of which the controller will be able to identify you in its own environment and thus provide you with data concerning you.
• The controller shall handle your request without undue delay, no later than 1 month of receipt of your request.

WHAT TO DO IF THE CONTROLLER DOES NOT RESPOND OR DOES NOT COMPLY WITH YOUR REQUEST?

• If the controller:
  • does not respond to your request within 1 month (or within an extended period)
  • does not comply with your request and you think he should have complied
  • replied to you request but you are not satisfied with his action

you have the right to lodge a complaint to the Office for Personal Data Protection of the Slovak Republic to initiate the personal data protection proceeding. 

• The template of the complaint as well as all the necessary more detailed information on such complaint and procedure can be found here.
• It is important to prepare evidence that confirms your statements in your complaint (e.g. a copy of the document by which you have exercised your rights with the controller, the controller´s response to your request, if he answered it).

In case you were unable to exercise your rights with the controller, it is necessary to state the reasons due to which it was not possible to do so.