V. CHAPTER
DETAILED INFORMATION ABOUT THE RELEVANT RIGHTS

Right to preliminary information
The data subject is entitled to be informed of facts and information related to data management prior to the commencement of data management.

A) Information to be provided when personal data is collected from the data subject

1. Where personal data relating to the data subject are collected from the data subject, the controller shall make available to the data subject at the time when the personal data are obtained:
(a) the identity and contact details of the controller and, if any, of the controller;
(b) the contact details of the data protection officer, if any;
(c) the purpose of the intended management of the personal data and the legal basis for the processing;
(d) in the case of data processing based on Article 6 (1) (f) of the Regulation (legitimate interest validation), the legitimate interests of the controller or of a third party;
(e) where applicable, the recipients of the personal data or categories of recipients;
(f) where applicable, the fact that the controller wishes to transfer personal data to a third country or an international organization, as well as the existence or absence of a Commission conformity decision or Article 46, Article 47 or Article 49 (1) of the Regulation; (c) in the case of the transmission referred to in the second subparagraph of paragraph 1, the indication of appropriate and suitable guarantees and the methods of obtaining a copy of them or their availability.

2. In addition to the information referred to in paragraph 1, the controller shall inform the data subject at the time of the acquisition of personal data, in order to ensure fair and transparent data management, of the following additional information:
(a) the duration of the storage of personal data or, where this is not possible, the criteria for determining that period;
(b) the right of the data subject to apply to the controller for access, rectification, erasure or restriction of personal data relating to him or her and to object to the processing of such personal data and his / her right to data portability;
or the legality of the data processing carried out on the basis of consent prior to the revocation;
(d) the right to lodge a complaint with the supervisory authority;
(e) whether the provision of personal data is based on a statutory or contractual obligation or a prerequisite for the conclusion of a contract, and whether the data subject is obliged to provide personal data and what the possible consequences of failure to provide the data may be;
(f) the fact that automated decision-making, including profiling, as referred to in Article 22 (1) and (4) of the Regulation, as well as at least in these cases the logic used and understandable information on the significance of such processing and the data subject; what are the expected consequences.

3. Where the controller wishes to process further data for personal purposes other than for the purpose for which they were collected, he shall inform the data subject of this different purpose and of any additional relevant information referred to in paragraph 2 before further processing.

4. Referring to 1-3. points are not applicable if and to what extent the data subject already has the information.
(Article 13 of Regulation)

B) Information to be provided if personal data were not obtained from the data subject

1. Where personal data have not been obtained from the data subject, the controller shall provide the following information to the data subject: \ t
(a) the identity and contact details of the controller and, if any, of the controller;
(b) the contact details of the data protection officer, if any;
(c) the purpose of the intended management of the personal data and the legal basis for the processing;
(d) the categories of personal data concerned;
(e) the recipients of the personal data or categories of recipients, if any;
(f) where applicable, the fact that the controller wishes to transfer personal data to a third country recipient or to an international organization, as well as to the existence or absence of a Commission conformity decision, or to Article 46, Article 47 or Article 49 of the Regulation. in the case of the transmission referred to in the second subparagraph of Article 1 (1), indication of appropriate and suitable guarantees and of the means by which they may be obtained or reference to their availability.

2. In addition to the information referred to in point 1, the controller shall provide the data subject with the following additional information necessary to ensure fair and transparent data management for the data subject: \ t
(a) the duration of the storage of personal data or, where this is not possible, the criteria for determining that period;
(b) if the processing is based on Article 6 (1) (f) of the Regulation (legitimate interest), on the legitimate interests of the controller or a third party;
(c) the right of the data subject to apply to the controller for access to, rectification, erasure or restriction of personal data relating to him or her and to object to the processing of personal data and his / her right to data portability;
or the legality of the data processing carried out on the basis of consent prior to the revocation;
(e) the right to lodge a complaint with a supervisory authority;
(f) the source of the personal data and, where appropriate, whether the data originate from publicly available sources; and
(g) the fact that automated decision-making, including profiling, as referred to in Article 22 (1) and (4) of the Regulation, as well as at least in these cases the logic used and understandable information on the significance of such processing and the data subject; what are the expected consequences.

3. The controller shall provide the information referred to in points 1 and 2 as follows:
(a) taking into account the specific circumstances of the processing of personal data, within a reasonable time limit after receipt of the personal data, but no later than one month;
(b) if personal data are used for the purpose of liaising with the data subject, at least at the time of first contact with the data subject; or
(c) at the latest at the time of the first communication of personal data, if the data are expected to be communicated to another addressee.

4. If the controller wishes to process further data for personal purposes other than for the purpose for which it was obtained, it shall inform the data subject about this different purpose and all relevant additional information referred to in point 2 before further processing.

5. does not apply if and to the extent:
(a) the data subject already has the information;
or or where the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously jeopardize the achievement of the purposes of this data management. In such cases, the controller shall take appropriate measures, including public disclosure of the information, to protect the rights, freedoms and legitimate interests of the data subject;
(c) the acquisition or communication of data is expressly provided for by the Union or Member State law applicable to the controller which provides for appropriate measures to protect the data subject’s legitimate interests; or
(d) personal data must remain confidential on the grounds of professional secrecy imposed by Union or Member State law, including statutory confidentiality obligations.
(Article 14 of Regulation)

Right of access of the data subject

1. The data subject has the right to receive feedback from the Data Controller on whether personal data are being processed and, if such processing is in progress, to have access to personal data and the following information:
(a) purposes of data management;
(b) the categories of personal data concerned;
(c) the categories of recipients or recipients to whom or with whom personal data have been communicated, including in particular third-country recipients or international organizations;
(d) where applicable, the planned duration of the storage of personal data or, where this is not possible, the criteria for determining that period;
(e) the right of the data subject to apply to the Data Controller for rectification, erasure or restriction of personal data relating to him or her and may object to the processing of such personal data;
(f) the right to lodge a complaint with a supervisory authority;
(g) if the data were not collected from the data subject, all available information on their source;
(h) the fact that automated decision-making, including profiling, as referred to in Article 22 (1) and (4) of the Regulation, as well as at least in these cases the logic used and understandable information on the significance of such processing and the data subject; expected consequences.

2. Where personal data are transferred to a third country or an international organization, the data subject shall have the right to be informed of the appropriate safeguards in accordance with Article 46 of the Regulation.

3. The Data Controller shall make available to the data subject a copy of the personal data subject to data management. The Controller may charge a reasonable fee based on administrative costs for additional copies requested by the data subject. If the data subject has submitted the application by electronic means, the information shall be made available in a widely used electronic format, unless otherwise requested by the data subject. The right to request a copy must not adversely affect the rights and freedoms of others.
(Article 15 of Regulation)

Right to delete ("the right to forget")

1. Upon request, the Data Controller shall have the right to delete personal data relating to him without undue delay, and the Data Controller shall delete personal data relating to the data subject without undue delay if one of the following reasons exists:
(a) personal data are no longer needed for the purpose for which they were collected or otherwise processed;
(b) the data subject’s consent to data processing is withdrawn by the data subject in accordance with Article 6 (1) (a) or Article 9 (2) (a) of the Regulation and the data processing has no other legal basis;
(c) the data subject objects to the processing of the data pursuant to Article 21 (1) of the Regulation and there are no legitimate reasons for the processing of the data or the data subject has objected to the processing pursuant to Article 21 (2);
d) personal data have been unlawfully treated;
(e) the personal data must be erased in order to fulfill a legal obligation under Union or Member State law applicable to the Data Controller;
(f) personal data were collected in connection with the provision of information society services referred to in Article 8 (1) of the Regulation.

2. If the Data Controller has disclosed personal data and is obliged to cancel it pursuant to paragraph 1 above, it shall take reasonable steps, including technical measures, to inform Data Controllers managing the data, taking into account the technology and implementation costs available. that the data subject has requested them to delete the relevant personal data links or a copy or duplicate of such personal data.

3. Points 1 and 2 shall not apply where data processing is necessary:
(a) to exercise the right to freedom of expression and information;
(b) fulfillment of an obligation under Union or Member State law which governs the processing of personal data or for the performance of a task carried out in the public interest or in the exercise of public authority conferred on the Data Controller;
(c) on grounds of public interest in the field of public health, in accordance with Article 9 (2) (h) and (i) of the Regulation and Article 9 (3);
(d) in accordance with Article 89 (1) of the Regulation, for the purpose of archiving in the public interest, for scientific and historical research purposes or for statistical purposes, where the right referred to in paragraph 1 is likely to render such processing impossible or seriously jeopardized; or
e) bringing, enforcing or protecting legal claims.
(Article 17 of Regulation)

Right to restrict data management

1. The data subject shall have the right to limit the data controller’s request, if one of the following is true:
(a) the data subject disputes the accuracy of the personal data, in which case the restriction shall apply to the period that allows the Data Controller to verify the accuracy of the personal data;
(b) the processing is unlawful and the data subject is against the deletion of the data and instead requests a restriction on their use;
c) the Data Controller no longer needs personal data for data management purposes, but the data subject requests them for the submission, validation or protection of legal claims; or
(d) the data subject has objected to the processing in accordance with Article 21 (1) of the Regulation; in this case, the limitation applies to the period until it is established whether the legitimate reasons of the Data Controller take precedence over the legitimate reasons of the data subject.

2. Where data processing is subject to restrictions under point 1, such personal data, except storage, shall only be made with the consent of the data subject or for the submission, validation or protection of legal claims or the protection of the rights of other natural or legal persons, or of the Union. of an important public interest in a Member State.

3. The Data Controller shall inform the data subject, at whose request the data management has been restricted pursuant to paragraph 1, in advance of the lifting of the restriction of data management.
(Article 18 of Regulation)

Right to data storage

1. The data subject shall have the right to receive personal data concerning him / her which is made available to him / her by the Data Controller in a distributed, widely used, machine-readable format, and shall be entitled to forward such data to another Data Controller without being prevented by the Data Controller. to whom you provided personal information to you if:
(a) the processing is based on a contribution pursuant to Article 6 (1) (a) or Article 9 (2) (a) of the Regulation or a contract pursuant to Article 6 (1) (b); and
b) data management is automated.

2. When exercising the right to portability of data under point 1, the data subject shall have the right to request, where technically feasible, the direct transmission of personal data between Data Controllers.

3. The exercise of this right shall be without prejudice to Article 17 of the Regulation. That right shall not apply where the processing is necessary for the performance of a task carried out in the exercise of public authority or in the exercise of official authority conferred on the Data Controller.

4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
(Article 20 of Regulation)

Right to protest

1. The data subject may at any time, for reasons connected with his or her own situation, object to his or her personal data in accordance with Article 6 (1) (e) of the Regulation (data processing required for the performance of a task carried out in the public interest or in the exercise of official authority conferred on the Data Controller) or point (f). (based on data management for the purpose of enforcing the legitimate interests of the Data Controller or a third party), including profiling based on those provisions. In this case, the Data Controller may not further process the personal data unless the Data Controller proves that the data management is justified by compelling legitimate reasons that take precedence over the interests, rights and freedoms of the data subject, or which are made to bring, validate or defend legal claims. related.

2. Where personal data are processed for the purpose of direct marketing, the data subject shall have the right to object at any time to the processing of personal data concerning him for that purpose, including profiling, where it is related to direct marketing.

3. If the data subject objects to the handling of personal data for the purpose of direct marketing, personal data may no longer be processed for that purpose.

4. The right referred to in points 1 and 2 shall be specifically brought to its attention at the latest when first contacting the data subject and shall be clearly and separately distinguished from any other information.

5. By way of derogation from Directive 2002/58 / EC relating to the use of information society services, the data subject may exercise the right of objection by automated means based on technical specifications.

6. Where the processing of personal data is carried out for scientific and historical research purposes or for statistical purposes in accordance with Article 89 (1) of the Regulation, the data subject shall have the right to object to the processing of personal data relating to him or her, for reasons other than his own, unless: if the processing is necessary for the performance of a task carried out for reasons of public interest.
(Article 21 of Regulation)

Automated decision making in individual cases, including profiling

1. The data subject shall have the right not to be subject to a decision based solely on automated data management, including profiling, which would have legal effect on him or would equally be significantly affected by it.

2. Point 1 shall not apply where the decision: \ t
(a) necessary for the conclusion or performance of a contract between the data subject and the Data Controller;
(b) it is made possible by Union or national law applicable to the Data Controller, which also lays down appropriate measures for the protection of the rights and freedoms of the data subject and the legitimate interests of the data subject; or
(c) is based on the explicit consent of the data subject.

3. In the cases referred to in points (a) and (c) of paragraph 2, the Data Controller shall take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, including at least the right of the data subject to seek the intervention of the Data Controller; and object to the decision.

4. The decisions referred to in paragraph 2 shall not be based on the specific categories of personal data referred to in Article 9 (1) of the Regulation, except where Article 9 (2) (a) or (g) applies and the rights of the data subject concerned. appropriate measures have been taken to protect their freedoms and legitimate interests.
(Article 22 of Regulation)

Limitations

1. EU or Member State law applicable to the Controller or data processor may limit the scope of Articles 12 to 22 of the Regulation by legislative measures. Articles 34 and 34 and Articles 12 to 22. In so far as it respects the essential content of fundamental rights and freedoms and the necessary and proportionate measures to protect the following in a democratic society, the scope of the rights and obligations contained in Article 5 shall be subject to the provisions of this Article in accordance with the rights and obligations laid down in Article 5: \ t
(a) national security;
b) national defense;
(c) public security;
(d) the prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal sanctions, including protection against and prevention of threats to public security;
(e) other overriding public interest objectives of the Union or a Member State, in particular of major economic or financial interest to the Union or a Member State, including monetary, budgetary and fiscal matters, public health and social security;
(f) protection of judicial independence and judicial procedures;
(g) the prevention, investigation, detection and prosecution of ethical misconduct in regulated professions;
(h) in the cases referred to in points (a) to (e) and (g), even occasionally, control, inspection or regulatory activities relating to the exercise of official authority;
(i) the protection of the data subject or the protection of the rights and freedoms of others;
j) enforcement of civil claims.

2. The legislative measures referred to in paragraph 1 shall, where appropriate, include detailed provisions at least: \ t
(a) for purposes of data processing or categories of data processing;
(b) categories of personal data;
(c) the scope of the restrictions imposed, \ t
(d) guarantees intended to abuse or to prevent unauthorized access or transmission;
e) to define the Data Controller or to define categories of Data Controllers;
(f) the duration of the data storage and the applicable guarantees, taking into account the nature, scope and objectives of the data management or data management categories;
(g) the risks to the rights and freedoms of those concerned;
(h) the right of the persons concerned to be informed of the restriction, unless this may adversely affect the purpose of the restriction.
(Article 23 of Regulation)

Informing the data subject of the privacy incident

1. If the data protection incident is likely to pose a high risk to the rights and freedoms of natural persons, the Data Controller shall inform the data subject of the data protection incident without undue delay.

2. The information referred to in point 1 provided to the data subject shall clearly and comprehensibly describe the nature of the data protection incident and shall include at least the information and measures referred to in Article 33 (3) (b), (c) and (d) of the Regulation.

3. The data subject need not be informed as referred to in point 1 if any of the following conditions is met:
(a) the Data Controller has implemented appropriate technical and organizational safeguards, and these measures have been applied to the data affected by the data protection incident, in particular those measures, such as the use of encryption, which are incomprehensible to persons who do not have access to personal data make the data;
(b) the Data Controller, following a data protection incident, has taken additional measures to ensure that the high risk referred to in paragraph 1 reported to the data subject’s rights and freedoms is no longer likely to materialize;
(c) the information would require a disproportionate effort. In such cases, the persons concerned shall be informed by means of publicly available information or a similar measure shall be taken to ensure that the persons concerned are equally informed.

4. If the Data Controller has not yet notified the data subject of the data protection incident, the supervisory authority, having considered whether the data protection incident is likely to pose a high risk, may order the data subject to be informed or determine whether one of the conditions referred to in point 3 has been met.
(Article 34 of Regulation)

Right to complain to the supervisory authority

1. Without prejudice to other administrative or judicial remedies, any person concerned shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he has his habitual residence, at the place of employment or in the Member State where the alleged infringement is committed, if the data subject considers that personal data relating to him were this Regulation.

2. The supervisory authority to which the complaint has been lodged shall inform the client of the procedural developments and the outcome of the complaint, including the right of the client to seek judicial remedy under Article 78 of the Regulation.
(Article 77 of Regulation)

Right to effective judicial redress against the supervisory authority

1. Without prejudice to other administrative or non-judicial remedies, any natural or legal person shall be entitled to effective judicial remedy against a legally binding decision of the supervisory authority.

2. Without prejudice to other administrative or non-judicial remedies, any person concerned shall have the right to an effective judicial remedy if the supervisory authority competent under Articles 55 or 56 of the Regulation does not deal with the complaint or does not inform the person concerned within three months. (d) the procedural developments or the outcome of a complaint under Article 4.

3. Proceedings against the supervisory authority shall be brought before the courts of the Member State where the supervisory authority has its registered office.

4. Where proceedings are brought against a decision of a supervisory authority in respect of which the Board has previously issued an opinion or a decision under the Unity Mechanism, the supervisory authority shall send that opinion or decision to the court.
(Article 78 of Regulation)

Right to effective judicial redress against the controller or the processor

1. Without prejudice to the available administrative or non-judicial remedies, including the right to lodge a complaint with the supervisory authority pursuant to Article 77 of the Regulation, any person concerned shall be entitled to an effective judicial remedy if he considers that his personal data have not been treated in accordance with this Regulation. their rights under this Regulation.

2. Proceedings against the controller or the processor shall be instituted before the courts of the Member State where the controller or the processor is established. Such proceedings may also be brought before the courts of the Member State in which the data subject is habitually resident, unless the controller or the processor is a public authority of a Member State acting in the exercise of public authority.
(Article 79 of Regulation)