menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Spain) language
Contact our local member in Spain mail_outline
Visit the website of M & AD 4 Law account_balance

arrow_backPrevious Article
Article 15
Next Articlearrow_forward

Right of access by the data subject

Official
Texts Guidelines
& Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 15 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 15 keyboard_arrow_up

Key words related to article 15

Show the recitals of the Regulation related to article 15 keyboard_arrow_down Hide the recitals of the Regulation related to article 15 keyboard_arrow_up

(63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.

(64) The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.

(73) Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing of archived personal data to provide specific information related to the political behaviour under former totalitarian state regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.

Show the recitals of the Directive related to article 15 keyboard_arrow_down Hide the recitals of the Directive related to article 15 keyboard_arrow_up

41) Whereas any person must be able to exercise the right of access to data relating to him which are being processed, in order to verify in particular the accuracy of the data and the lawfulness of the processing; whereas, for the same reasons, every data subject must also have the right to know the logic involved in the automatic processing of data concerning him, at least in the case of the automated decisions referred to in Article 15 (1); whereas this right must not adversely affect trade secrets or intellectual property and in particular the copyright protecting the software; whereas these considerations must not, however, result in the data subject being refused all information;

(42) Whereas Member States may, in the interest of the data subject or so as to protect the rights and freedoms of others, restrict rights of access and information; whereas they may, for example, specify that access to medical data may be obtained only through a health professional;

(43) Whereas restrictions on the rights of access and information and on certain obligations of the controller may similarly be imposed by Member States in so far as they are necessary to safeguard, for example, national security, defence, public safety, or important economic or financial interests of a Member State or the Union, as well as criminal investigations and prosecutions and action in respect of breaches of ethics in the regulated professions; whereas the list of exceptions and limitations should include the tasks of monitoring, inspection or regulation necessary in the three last-mentioned areas concerning public security, economic or financial interests and crime prevention; whereas the listing of tasks in these three areas does not affect the legitimacy of exceptions or restrictions for reasons of State security or defence;

(44) Whereas Member States may also be led, by virtue of the provisions of Community law, to derogate from the provisions of this Directive concerning the right of access, the obligation to inform individuals, and the quality of data, in order to secure certain of the purposes referred to above;

The GDPR

The Regulation does not actually provide for anything new as to the right to access but accepts the principle contained in the Directive: the data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data.

Specific information must be given pursuant to the right of access. Compared to the previous system, new information elements are provided for, such as, in particular, the obligation to inform the data subject about the period of storage, of their right to rectification and erasure, of their right to lodge a complaint with a supervisory authority, of the specific safeguards taken in case of data transfer to a third country or an international organization or information on the existence of an automated decision including profiling.

If so requested, the data subject is entitled to be issued a copy of the data. Such copy must be free of charge because the final text provide for a payment of fees on the basis of the administrative costs of controller for the subsequent copies only. On the other hand, the text says nothing about the possible costs related to the access without a copy (while the previous version explicitly provided for the free access with no payment at regular intervals). The provision also states that the information may be provided electronically, unless otherwise requested, when the request for access was made electronically.

Finally, the final version of the Regulation stipulates in paragraph 4 that the right to obtain a copy must not adversely affect the rights and freedoms of others. In the previous version of the Regulation, an exception to the right to obtain a copy could be made if the issue of copies involved the disclosure of confidential data or was likely to infringe intellectual property rights on processing.

The Directive

In its Article 12, the Directive already granted a broad right of access to e data to data subjects.

Potential issues

For controllers who have already implemented a procedure for access to their processing, the new provision will bring an update only.

The only exception to the right to obtain a copy of data undergoing processing in Article 15 (4) however, leaves us puzzled. According to this provision, the right to obtain a copy may not adversely affect the rights and freedoms of others.

The exception is dangerous insofar as it is formulated too broadly and that it seems to imply that any conflict between, on one hand, the right to obtain a copy and, on the other hand, the rights and freedoms of others will be always settled to the prejudice to the first one, which would be unacceptable.

arrow_back Previous Article • Article 15 • Next Article arrow_forward
arrow_back Previous Article • Article 15 Next Article arrow_forward

Group 29

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (6 February 2018)

(Endorsed by the EDPB)

The General Data Protection Regulation (the GDPR), specifically addresses profiling and automated individual decision-making, including profiling.

Profiling and automated decision-making are used in an increasing number of sectors, both private and public. Banking and finance, healthcare, taxation, insurance, marketing and advertising are just a few examples of the fields where profiling is being carried out more regularly to aid decision-making.

Advances in technology and the capabilities of big data analytics, artificial intelligence and machine learning have made it easier to create profiles and make automated decisions with the potential to significantly impact individuals’ rights and freedoms.

The widespread availability of personal data on the internet and from Internet of Things (IoT) devices, and the ability to find correlations and create links, can allow aspects of an individual’s personality or behaviour, interests and habits to be determined, analysed and predicted.

Profiling and automated decision-making can be useful for individuals and organisations, delivering benefits such as:

  • increased efficiencies; and
  • resource savings.

They have many commercial applications, for example, they can be used to better segment markets and tailor services and products to align with individual needs. Medicine, education, healthcare and transportation can also all benefit from these processes.

However, profiling and automated decision-making can pose significant risks for individuals’ rights and freedoms which require appropriate safeguards.

These processes can be opaque. Individuals might not know that they are being profiled or understand what is involved.

Profiling can perpetuate existing stereotypes and social segregation. It can also lock a person into a specific category and restrict them to their suggested preferences. This can undermine their freedom to choose, for example, certain products or services such as books, music or newsfeeds. In some cases, profiling can lead to inaccurate predictions. In other cases it can lead to denial of services and goods and unjustified discrimination.

The GDPR introduces new provisions to address the risks arising from profiling and automated decision-making, notably, but not limited to, privacy. The purpose of these guidelines is to clarify those provisions.

This document covers:

  • Definitions of profiling and automated decision-making and the GDPR approach to these in general – Chapter II
  • General provisions on profiling and automated decision-making – Chapter III
  • Specific provisions on solely automated decision-making defined in Article 22 - Chapter IV
  • Children and profiling – Chapter V
  • Data protection impact assessments and data protection officers– Chapter VI

The Annexes provide best practice recommendations, building on the experience gained in EU Member States.

The Article 29 Data Protection Working Party (WP29) will monitor the implementation of these guidelines and may complement them with further details as appropriate.

Link

CJEU caselaw

C-553/07 (7 May 2009)

Article 12(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data requires Member States to ensure a right of access to information on the recipients or categories of recipient of personal data and on the content of the data disclosed not only in respect of the present but also in respect of the past. It is for Member States to fix a time-limit for storage of that information and to provide for access to that information which constitutes a fair balance between, on the one hand, the interest of the data subject in protecting his privacy, in particular by way of his rights to object and to bring legal proceedings and, on the other, the burden which the obligation to store that information represents for the controller.

Rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of one year and correspondingly limiting access to that information, while basic data is stored for a much longer period, do not constitute a fair balance of the interest and obligation at issue, unless it can be shown that longer storage of that information would constitute an excessive burden on the controller. It is, however, for national courts to make the determinations necessary.

Opinion of Advocate general

Judgment of the Court

C-486/12 (12 December 2013)

1.      Article 12(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as not precluding the levying of fees in respect of the communication of personal data by a public authority.

2.      Article 12(a) of Directive 95/46 must be interpreted as meaning that, in order to ensure that fees levied when the right to access personal data is exercised are not excessive for the purposes of that provision, the level of those fees must not exceed the cost of communicating such data. It is for the national court to carry out any verifications necessary, having regard to the circumstances of the case.

Judgment of the Court

C-131/12 (13 May 2014)

1.      Article 2(b) and (d) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data are to be interpreted as meaning that, first, the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) when that information contains personal data and, second, the operator of the search engine must be regarded as the ‘controller’ in respect of that processing, within the meaning of Article 2(d).

2.      Article 4(1)(a) of Directive 95/46 is to be interpreted as meaning that processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.

3.      Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.

4.      Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted as meaning that, when appraising the conditions for the application of those provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him personally should, at this point in time, no longer be linked to his name by a list of results displayed following a search made on the basis of his name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject. As the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question.

Opinion of Advocate general

Judgment of the Court

C-141/12 ; C-372/12 (17 July 2014)

1.      Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the data relating to an applicant for a residence permit contained in an administrative document, such as the ‘minute’ at issue in the main proceedings, setting out the grounds that the case officer puts forward in support of the draft decision which he is responsible for drawing up in the context of the procedure prior to the adoption of a decision concerning the application for such a permit and, where relevant, the data in the legal analysis contained in that document, are ‘personal data’ within the meaning of that provision, whereas, by contrast, that analysis cannot in itself be so classified.

2.      Article 12(a) of Directive 95/46 and Article 8(2) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that an applicant for a residence permit has a right of access to all personal data concerning him which are processed by the national administrative authorities within the meaning of Article 2(b) of that directive. For that right to be complied with, it is sufficient that the applicant be in possession of a full summary of those data in an intelligible form, that is to say a form which allows that applicant to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him by that directive.

3.      Article 41(2)(b) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that the applicant for a residence permit cannot rely on that provision against the national authorities.

Opinion of Advocate general

Judgment of the Court

C-398/15 (9 March 2017)

Article 6(1)(e), Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, read in conjunction with Article 3 of the First Council Directive 68/151/EEC of 9 March 1968 on co-ordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 58 of the Treaty, with a view to making such safeguards equivalent throughout the Community, as amended by Directive 2003/58/EC of the European Parliament and of the Council of 15 July 2003, must be interpreted as meaning that, as EU law currently stands, it is for the Member States to determine whether the natural persons referred to in Article 2(1)(d) and (j) of that directive may apply to the authority responsible for keeping, respectively, the central register, commercial register or companies register to determine, on the basis of a case-by-case assessment, if it is exceptionally justified, on compelling legitimate grounds relating to their particular situation, to limit, on the expiry of a sufficiently long period after the dissolution of the company concerned, access to personal data relating to them, entered in that register, to third parties who can demonstrate a specific interest in consulting that data.

Opinion of Advocate general

Judgment of the Court 

C‑507/17 (24 september 2019)

On a proper construction of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and of Article 17(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 (General Data Protection Regulation), where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request.

Opinion of Advocate general 

Judgment of the Court 

arrow_back Previous Article • Article 15 Next Article arrow_forward
Regulation
1e 2e

Art. 15

1.   The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to their source;

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

2.   Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

3.   The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

4.   The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
1st proposal close

Art. 15

1.           The data subject shall have the right to obtain from the controller at any time, on request, confirmation as to whether or not personal data relating to the data subject are being processed. Where such personal data are being processed, the controller shall provide the following information:

(a)     the purposes of the processing;

(b)     the categories of personal data concerned;

(c)     the recipients or categories of recipients to whom the personal data are to be or have been disclosed, in particular to recipients in third countries;

(d)     the period for which the personal data will be stored;

(e)     the existence of the right to request from the controller rectification or erasure of personal data concerning the data subject or to object to the processing of such personal data;

(f)      the right to lodge a complaint to the supervisory authority and the contact details of the supervisory authority;

(g)     communication of the personal data undergoing processing and of any available information as to their source;

(h)     the significance and envisaged consequences of such processing, at least in the case of measures referred to in Article 20.

2.           The data subject shall have the right to obtain from the controller communication of the personal data undergoing processing. Where the data subject makes the request in electronic form, the information shall be provided in electronic form, unless otherwise requested by the data subject.

3.           The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the communication to the data subject of the content of the personal data referred to in point (g) of paragraph 1.

4.           The Commission may specify standard forms and procedures for requesting and granting access to the information referred to in paragraph 1, including for verification of the identity of the data subject and communicating the personal data to the data subject, taking into account the specific features and necessities of various sectors and data processing situations. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
2nd proposal close

Art. 15

1. The data subject shall have the right to obtain from the controller at

reasonable intervals and free of charge (...) confirmation as to whether or not personal data concerning him or her are being processed and w here such personal data are being processed access to the data and the following information:

(a) the purposes of the processing;

(b) (...)

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of the processing of personal data concerning the data subject or to object to the processing of such personal data;

(f) the right to lodge a complaint to a supervisory authority (...) ;

(g) where the personal data are not collected from the data subject, any available information as to their source;

(h) in the case of decisions based on automated processing including profiling referred to in Article 20(1) and (3), information concerning the logic involved as well as the significance and envisaged consequences of such processing.

1a. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 42 relating to the transfer.

1b. On request and without an excessive charge, the controller shall provide a copy of the personal data undergoing processing to the data subject.

2. (...)

2a. The right to obtain a copy referred to in paragraph 1b (...) shall not apply where such copy cannot be provided without disclosing personal data of other data subjects or confidential data of the controller. Furthermore, this right shall not apply if disclosing personal data would infringe intellectual property rights in relation to processing of those personal data.

3. (...)

4. (...)

 

 
Directive close

Art. 12

Member States shall guarantee every data subject the right to obtain from the controller:

(a) without constraint at reasonable intervals and without excessive delay or expense:

- confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,

- communication to him in an intelligible form of the data undergoing processing and of any available information as to their source,

- knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions referred to in Article 15 (1);

(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;

(c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.
Spain
compare_arrows

Article 14. Right to consult the General Data Protection Register.- Organic Law 15/1999 on the protection of Personal Data.-

Anyone may consult the General Data Protection Register to learn about the existence of personal data, their purpose and the identity of the controller. The General Register shall be open to public consultation free of charge.

Article 15.- Right of access.- Organic Law 15/1999 on the protection of Personal Data.-

1. The data subject shall have the right to request and obtain free of charge information on his personal data subjected to processing, on the origin of such data and on their communication or intended communication.

2. The information may be obtained by simply displaying the data for consultation or by indicating the data subjected to processing in writing, or in a copy, fax or photocopy, whether certified a true copy or not, in legible and intelligible form, and without using keys or codes which require the use of specific devices.

3. The right of access referred to in this Article may be exercised only at intervals of not less than twelve months, unless the data subject can prove a legitimate interest in doing so, in which case it may be exercised before then.

Article 27.- RIght of Access.- Royal Decree 1720/2007 Implementing the Organic Law 15/1999.-

1. The right of access is the right of the data subject to obtain information about whether his own personal data is subject to processing, the purpose of the processing that, if appropriate, is being done, as well as the information available on the origin of such data and the communications made or planned for them.

2. By virtue of the right of access the data subject may obtain from the data controller information regarding specific data, data included in a certain file, or the entire set of his data subjected to processing.

The aforesaid notwithstanding, when reasons of particular complexity justify it, the data controller may ask the data subject to specify the files for which he wishes to exercise the right of access, for which purpose he shall provide him a list of all the files.

3. The right of access is independent from that granted to data subjects by special laws and in particular by Act 30/1992, of 26 November, on the Legal System of the Public Administration and the Common Administrative Procedure.

Article 28.- Exercising the Right of Access.- Royal Decree 1720/2007 Implementing the Organic Law 15/1999.-

1. Upon exercising the right of access, the data subject may choose to receive the information through one or several of the following file consultation systems:

a) Screen display.

b) Letter, copy or photocopy sent by post, registered or not.

c) Facsimile.

d) E-mail or other electronic communication systems.

e) Any other system that is suitable to the configuration or material implementation of the filing system or to the nature of the processing, offered by the data controller.

2. The file consultation systems provided in the previous subsection may be restricted depending on the configuration or material implementation of the filing system or the nature of the processing, whenever that offered to the data subject is free and ensures written communication if so required.

3. Upon facilitating access the data controller shall comply with the provisions of Title VIII hereof.

Should the data controller offer a specific system for the effective exercise of the right of access and the data subject rejects it, the data controller shall not be liable for the possible risks to the security of the information that may arise from the choice.

Similarly, if the data controller offers a specific system for the effective exercise of the right of access and the data subject demands it be done through a procedure that involves a disproportionate cost, being similarly effective and guaranteeing the same security as the procedure offered by the data controller, the costs arising from such a decision shall be at the expense of the data subject.

Article 29.- Granting Access.- Royal Decree 1720/2007 Implementing the Organic Law 15/1999.-

1. The data controller shall settle the request for access within one month from its receipt. On the expiry of this time limit, if the request for access has not been expressly answered, the data subject may file a claim provided in Article 18 of Organic Law 15/1999, of 13 December.

Should the data controller not hold data subject’s personal data, he shall equally communicate this within the same period of time.

2. If the request is upheld and the data controller does not include in his communication the information to which Article 27.1 refers, access shall be made effective within the ten days following such communication.

3. The information provided, by whatever means, shall be legible and understandable, without using keys or codes that require the use of specific mechanical devices.

Such information shall comprise all the basic data of the data subject, those resulting from any computer process or preparation, as well as the information available on the origin of the data, their recipients and specification of the particular uses and purposes for which data has been stored.

Article 30.- Denial of Access.- Royal Decree 1720/2007 Implementing the Organic Law 15/1999.-

1. The data controller may deny access to the personal data when the right has already been exercised during the twelve months prior to the request, unless a legitimate interest is accredited for this purpose.

2. Access may also be denied if thus provided by law or a directly applicable community rule of law or when these prevent the data controller from disclosing to data subjects the processing of the data to which the access refers.

3. In any case, the data controller shall inform the data subject of his right to obtain the protection of the Spanish Data Protection Agency or, if appropriate, the supervisory authorities of the Autonomous Communities, pursuant to the provisions of Article 18 of Organic Law 15/1999, of 13 December.

 

 

 
arrow_back Previous Article • Article 15 Next Article arrow_forward
close

2016 - www.itiplaw.eu.