What are my rights pursuat to the Data Protection Act

Everyone has a right to know who, where and in what manner processes his personal data. Everyone has also a right to request rectification, liquidation or object towards personal data processing. Data subject is entitled to exercise these and other rights recognized by the PDP ACT towards any controller. Rights of data subjects are in the PDP Act addressed in following manner:

What are my rights of Access?

Upon a written application, the data subject is entitled to request from the controller:

1. confirmation whether his personal data are being processed. The controller is obliged to satisfy this request free of charge.
2. information about the state of processing of his personal data in the filing system in a generally intelligible form and in the extent under Section 15 Paragraph 1 Point a) to e) Number 1to 6 of the PDP Act; if a decision under Paragraph 5 of the mentioned act is issued, the data subject shall be entitled to familiarize himself with the procedure of the processing and evaluating of operations. The controller is obliged to satisfy this request and provide the data subject with the requested information free of charge,
3. exact information, in a generally intelligible form, about the source from which the controller obtained his personal data for their processing. The controller is obliged to provide this information free of charge,
4. a copy of his personal data, in a generally intelligible form, which constitute the subject of the processing. The controller is obliged to provide this information free of charge, except for a fee in the amount not exceeding the amount of material costs accrued in connection with the making of copies, providing technical carriers and sending the information to the data subject, unless otherwise stipulated by a special Act,
5. rectification of inaccurate, incomplete or not updated information, which constitute the subject of the processing. The controller is obliged to satisfy this request and provide the data subject with the requested information free of charge,
6. destruction of his personal data, if the purpose of their processing was fulfilled; if any official documents containing personal data constitute the subject of the processing, he may request their returning. The controller is obliged to satisfy this request and provide the data subject with the requested information free of charge,
7. blocking of his personal data due to the cancelation of the consent for personal data processing before its expiration if controller processes personal data based on this consent. The controller is obliged to satisfy this request and provide the data subject with the requested information free of charge.

The controller is obliged to satisfy the data subject´s request free of charge, except for a fee in the amount not exceeding the amount of material costs accrued in connection with the making of copies, providing technical carriers and sending the information to the data subject, unless otherwise stipulated by a special Act.

What may I object to and where may I submit my objections?

The data subject has a right to object to:

1. the processing of personal data, in respect of which the data subject expects that they are or would be processed for the purposes of direct marketing without his consent and he shall be entitled to request for their destruction,
2. the use of the personal data referred to in Section 10 Paragraph 3 point d) of the PDP Act (namely: title, name, surname and address) for the purposes of direct marketing in the mail correspondence; or
3. the provision of personal data referred to in Section 10 Paragraph 3 point d) of the PDP Act (namely: title, name, surname and address) for the purposes of direct marketing.

What other rights do I have?

In addition, the data subject has a right at any time to raise objections to the controller towards the processing by stating the legitimate reasons or by submitting evidence of infringement of his rights and legitimate interests that are or can be violated by the processing of personal data in a concrete case. This right may be e executed in following case.

• of processing of personal data is necessary for the purpose of artistic or literary works, for the purpose of informing the public by means of the mass media,
• data have already been disclosed pursuant to Law,
• processing of personal data is necessary for fulfilment of an important task carried out in public interest,
• processing of personal data is necessary for protection of rights and interests protected by law of the controller or the third party

Provided that it is proved that the legitimate reasons do not prevent it and the objection of the data subject is valid, the controller shall be obliged to block the personal data, the processing of which was objected by the data subject without undue delay and erase them as soon as possible.

The data subject shall be further entitled anytime upon a written request or in person, provided that the matter cannot be postponed to object to the controller and refuse to submit to the controller’s decision, which would produce legal effects on him or significantly affect him, provided that such decision is based solely on the acts of the automatic processing of his personal data. The data subject shall be entitled to request the controller for examination of the issued decision by a method other than the automatic processing, whereas the controller shall be obliged to satisfy the request of the data subject in such manner that the entitled person shall have a decisive role in the examination of the decision. The controller shall inform the data subject about the manner of examination and the outcome of his finding in a period not shorter than 30 days.

The data subject shall be deprived of the above right only if so stipulated by a special Act in which are regulated the measures for securing the legitimate rights of the data subject or if the controller issued a decision satisfying the request of the data subject during the pre-contractual relationship or in the course of existence of contractual relationship or if the controller adopted other adequate measures to ensure data subject´s legitimate interests based on the contract.