Legal information

Section 1 – Transparency and procedures
(Article 12 – GDPR) – Transparency of information and communications and arrangements for exercising the data subject’s rights
Section 2 – Information and access to personal data
(Article 13 – GDPR) – Information to be provided when personal data are collected from the data subject
(Article 14 – GDPR) – Information to be provided where personal data have not been obtained from the data subject
(Article 15 – GDPR) – Data subject’s right of access
(Section 3 – Rectification and erasure
(Article 16 – RGPD) – Right of rectification
(Article 17 – GDPR) – Right to erasure (“right to be forgotten”)
(Article 18 – GDPR) – Right to restriction of processing
(Article 19 – GDPR) – Duty of notification regarding rectification or erasure of personal data or restriction of processing
(Article 20 – GDPR) – Right to data portability
Section 4 – Right to object and automated individual decision-making
(Article 21 – GDPR) – Right to object
(Article 22 – GDPR) – Automated individual decision-making, including profiling
Section 5 – Limitations
(Article 23 – RGPD) – Limitations

________________________________________

Section 1 – Transparency and terms and conditions

________________________________________

Article 12 – Transparency of information and communications and arrangements for exercising the rights of the data subject
1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and to make any communication under Articles 15 to 22 and Article 34 concerning the processing to the data subject in a concise, transparent, comprehensible and easily accessible manner, in clear and simple language, in particular for any information specifically intended for a child. Information shall be provided in writing or by other means including, where appropriate, electronic means. Where the data subject so requests, information may be provided orally, provided that the identity of the data subject is established by other means.

3. The controller shall provide the data subject with information on the measures taken in response to a request made pursuant to Articles 15 to 22 as soon as possible and in any event within one month of receipt of the request. If necessary, this period may be extended by two months, taking into account the complexity and number of requests. The controller shall inform the data subject of this extension and of the reasons for the postponement within one month of receipt of the request. Where the data subject submits his/her request in electronic form, the information shall be provided electronically where possible, unless the data subject requests otherwise.
4. If the controller does not comply with the request made by the data subject, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for its failure to act and of the possibility of lodging a complaint with a supervisory authority and of seeking judicial remedy.

4. If the controller does not comply with the request made by the data subject, it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for its inaction and of the possibility of lodging a complaint with a supervisory authority and of seeking judicial remedy.
5. No payment shall be required for providing information under Articles 13 and 14 and for making any communication and taking any action under Articles 15 to 22 and Article 34. Where a data subject’s requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the controller may:
(a) require the payment of reasonable charges which take into account the administrative costs incurred in providing the information, making the communications or taking the measures requested; or
b) refuse to comply with such requests.
It shall be for the data controller to demonstrate that the request is manifestly unfounded or excessive.

6. Without prejudice to Article 11, where the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21, it may request that additional information necessary to confirm the identity of the data subject be supplied.
7. The information to be communicated to data subjects pursuant to Articles 13 and 14 may be supplied together with standardised icons in order to provide a clear, easily visible, comprehensible and clearly legible overview of the intended processing operation. Where icons are provided electronically, they shall be machine-readable.
8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented in the form of icons and the procedures governing the provision of standardised icons.

________________________________________

Section 2 – Information and access to personal data

________________________________________

Article 13 – Information to be provided when personal data are collected from the data subject
1. When personal data relating to a data subject are collected from that person, the controller shall provide him, at the time when the data in question are obtained, with all the following information:
(a) the identity and contact details of the controller and, where appropriate, of the controller’s representative
b) where applicable, the contact details of the Data Protection Officer;
c) the purposes of the processing for which the personal data are intended and the legal basis for the processing;
d) where the processing is based on Article 6(1)(f), the legitimate interests pursued by the controller or by a third party;
e) the recipients or categories of recipients of the personal data, if any; and

(f) where applicable, the fact that the controller intends to transfer personal data to a third country or to an international organisation, and the existence or absence of an adequacy decision by the Commission or, in the case of transfers referred to in Article 46 or 47, or in the second subparagraph of Article 49(1), the reference to the appropriate or adequate safeguards and the means of obtaining a copy thereof or the place where they have been made available;
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject, at the time the personal data are obtained, with the following further information which is necessary to ensure fair and transparent processing:
a) how long the personal data will be kept or, where this is not possible, the criteria used to determine this period;
b) the existence of the right to request from the controller access to, rectification or erasure of personal data, or a restriction on the processing relating to the data subject, or the right to object to the processing and the right to data portability;

(c) where processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent carried out prior to withdrawal of consent;
d) the right to lodge a complaint with a supervisory authority;
e) information as to whether the requirement to provide personal data is of a regulatory or contractual nature or whether it is a condition for the conclusion of a contract and whether the data subject is obliged to provide the personal data, as well as the possible consequences of failure to provide such data;
f) the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4), and, at least in such cases, useful information concerning the underlying logic and the significance and expected consequences of such processing for the data subject.
3. Where the controller intends to further process personal data for a purpose other than that for which the personal data was collected, it shall provide the data subject in advance with information about that other purpose and any other relevant information referred to in paragraph 2.

4. Paragraphs 1, 2 and 3 shall not apply where, and insofar as, the data subject already has this information.

________________________________________

Article 14 – Information to be supplied where the personal data have not been obtained from the data subject
1. Where the personal data have not been obtained from the data subject, the controller shall provide the data subject with all the following information:
a) the identity and contact details of the controller and, where applicable, of the representative of the controller;
b) where applicable, the contact details of the Data Protection Officer;
c) the purposes of the processing for which the personal data are intended and the legal basis for the processing;
d) the categories of personal data concerned;
e) where appropriate, the recipients or categories of recipients of the personal data;
(f) where applicable, the fact that the controller intends to transfer personal data to a recipient in a third country or to an international organisation, and the existence or absence of an adequacy decision by the Commission or, in the case of transfers referred to in Article 46 or 47 or in the second subparagraph of Article 49(1), the reference to the appropriate or adequate safeguards and the means of obtaining a copy of them or the place where they have been made available;

2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:
(a) the period for which the personal data will be kept or, where this is not possible, the criteria used to determine that period;
b) where processing is based on Article 6(1)(f), the legitimate interests pursued by the controller or by a third party;
c) the existence of the right to request from the controller access to personal data, their rectification or erasure, or a restriction on the processing relating to the data subject, as well as the right to object to the processing and the right to data portability;
d) where processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent carried out prior to withdrawal of consent;
e) the right to lodge a complaint with a supervisory authority;

(f) the source from which the personal data originate and, where appropriate, a statement as to whether or not they originate from publicly available sources;
(g) the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, relevant information concerning the underlying logic and the significance and expected consequences of such processing for the data subject.
3. The controller shall provide the information referred to in paragraphs 1 and 2:
(a) within a reasonable time after obtaining the personal data, but not exceeding one month, having regard to the specific circumstances in which the personal data are processed;
b) if the personal data are to be used for the purpose of communicating with the data subject, at the latest at the time of the first communication to the data subject; or
c) if disclosure to another recipient is envisaged, at the latest when the personal data is first disclosed.

4. Where the controller intends to further process personal data for a purpose other than that for which the personal data were obtained, it shall provide the data subject in advance with information about that other purpose and any other relevant information referred to in paragraph 2.
5. Paragraphs 1 to 4 shall not apply where and insofar as:
(a) the data subject already has such information;
(b) the provision of such information proves impossible or would require a disproportionate effort, in particular for processing for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes subject to the conditions and safeguards referred to in Article 89(1), or insofar as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously compromise the achievement of the purposes of such processing. In such cases, the controller shall take appropriate steps to protect the rights and freedoms and legitimate interests of the data subject, including by making the information publicly available;

(c) obtaining or communicating the information is expressly provided for by Union law or the law of the Member State to which the controller is subject and which provides for appropriate measures to protect the data subject’s legitimate interests; or
(d) the personal data must be kept confidential by virtue of an obligation of professional secrecy governed by Union law or the law of the Member States, including a statutory obligation of professional secrecy.

________________________________________

Article 15 – Data subject’s right of access
1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him are being processed and, where such data are being processed, access to such personal data and the following information:
a) the purposes of the processing
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients established in third countries or international organisations;
d) where possible, the period for which the personal data is to be stored or, where this is not possible, the criteria used to determine this period;
e) the existence of the right to request from the controller the rectification or erasure of personal data, or a restriction on the processing of personal data relating to the data subject, or the right to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, any available information as to its source;

2. Where personal data is transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards, pursuant to Article 46, in relation to that transfer.
3. The controller shall provide a copy of the personal data being processed. The controller may charge a reasonable fee based on administrative costs for any additional copies requested by the data subject. Where the data subject submits his or her request electronically, the information shall be provided in a commonly used electronic form, unless the data subject requests otherwise.
4. The right to obtain a copy referred to in paragraph 3 shall be without prejudice to the rights and freedoms of others.

________________________________________

Section 3 – Rectification and deletion

________________________________________

Article 16 – Right of rectification
The data subject shall have the right to obtain from the controller, as soon as possible, the rectification of inaccurate personal data relating to him or her. Having regard to the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing an additional declaration.

________________________________________

Article 17 – Right to erasure (“right to be forgotten”)
1. The data subject shall have the right to obtain from the controller the erasure, as soon as possible, of personal data relating to him or her and the controller shall have an obligation to erase such personal data as soon as possible, where one of the following grounds applies:
a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

b) the data subject withdraws the consent on which the processing is based, in accordance with Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for the processing;
c) the data subject objects to the processing under Article 21(1) and there are no compelling legitimate grounds for the processing, or the data subject objects to the processing under Article 21(2);
d) the personal data has been processed unlawfully;
e) the personal data must be erased in order to comply with a legal obligation laid down by Union law or by the law of the Member State to which the controller is subject;
(f) the personal data have been collected in connection with the provision of information society services as referred to in Article 8(1).

2. Where the controller has made the personal data public and is required to erase them pursuant to paragraph 1, the controller shall, having regard to available technology and the costs of implementation, take reasonable steps, including technical steps, to inform the controllers processing those personal data that the data subject has requested the erasure by those controllers of any link to, or any copy or reproduction of, those personal data.
3. Paragraphs 1 and 2 shall not apply insofar as such processing is necessary:
a) to exercise the right to freedom of expression and information;
(b) to comply with a legal obligation which requires processing and which is laid down by Union law or by the law of the Member State to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;
(c) for reasons of public interest in the field of public health, in accordance with Article 9(2)(h) and (i) and Article 9(3);

(d) for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1), insofar as the right referred to in paragraph 1 is likely to make impossible or seriously compromise the achievement of the purposes of such processing; or
e) for the establishment, exercise or defence of legal claims.

________________________________________

Article 18 – Right to restrict processing
1. The data subject shall have the right to obtain from the controller the restriction of processing where one of the following applies:
(a) the accuracy of the personal data is contested by the data subject, for a period allowing the controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject objects to the erasure of the personal data and demands instead that its use be restricted;
c) the controller no longer needs the personal data for the purposes of the processing operation, but the data are still necessary for the data subject to establish, exercise or defend legal claims;
(d) the data subject has objected to the processing pursuant to Article 21(1) during the verification as to whether the legitimate grounds pursued by the controller override those of the data subject.

2. Where processing has been restricted pursuant to paragraph 1, such personal data may, with the exception of storage, be processed only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or on important Union or Member State public interest grounds.
3. A data subject who has obtained the restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.

________________________________________

Article 19 – Obligation to notify rectification or erasure of personal data or restriction of processing
The controller shall notify each recipient to whom personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless such notification proves impossible or involves a disproportionate effort. The controller shall provide the data subject with information about such recipients if he or she so requests.

________________________________________

Article 20 – Right to data portability
1. Data subjects shall have the right to receive personal data relating to them which they have supplied to a controller, in a structured, commonly used and machine-readable format, and shall have the right to transmit those data to another controller without any obstacle from the controller to whom the personal data have been communicated, where:
(a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b); and
b) the processing is carried out using automated processes.
2. Where the data subject exercises his right to data portability pursuant to paragraph 1, he shall have the right to obtain that the personal data be transmitted directly from one controller to another, where technically possible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not affect the rights and freedoms of third parties.

________________________________________

Section 4 – Right to object and automated individual decision-making

________________________________________

Article 21 – Right to object
1. The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her based on Article 6(1)(e) or (f), including profiling based on those provisions. The controller shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests and rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
2. Where personal data is processed for canvassing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such canvassing purposes, including profiling insofar as it is linked to such canvassing.
3. Where the data subject objects to the processing for canvassing purposes, the personal data shall no longer be processed for such purposes.

4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
5. In the context of the use of Information Society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his right to object by means of automated procedures using technical specifications.
6. Where personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1), the data subject shall have the right to object, on grounds relating to his or her particular situation, to the processing of personal data relating to him or her, unless the processing is necessary for the performance of a task carried out in the public interest.

________________________________________

Article 22
Automated individual decision, including profiling
1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in a similar way.
2. Paragraph 1 shall not apply where the decision:
(a) is necessary for the conclusion or performance of a contract between the data subject and a controller;
(b) is authorised by Union law or by the law of the Member State to which the controller is subject and which also lays down appropriate measures to safeguard the rights and freedoms and the legitimate interests of the data subject; or
(c) is based on the explicit consent of the data subject.
3. In the cases referred to in paragraph 2(a) and (c), the controller shall implement appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, at least the right of the data subject to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

4. The decisions referred to in paragraph 2 may not be based on the special categories of personal data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject are in place.

________________________________________

Section 5 – Limitations

________________________________________

Article 23 – Limitations
1. Union law or the law of the Member State to which the controller or the processor is subject may, by means of legislative measures, restrict the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, and in Article 5 insofar as the provisions of the law in question correspond to the rights and obligations provided for in Articles 12 to 22, where such restriction respects the essence of fundamental rights and freedoms and constitutes a necessary and proportionate measure within a democratic society to safeguard:
(a) national security
(b) national defence
(c) public security
(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including protection against and prevention of threats to public security;
(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;

f) protecting the independence of the judiciary and legal proceedings;
g) the prevention, detection, investigation and prosecution of breaches of professional ethics in the regulated professions;
h) a monitoring, inspection or regulatory task connected, even occasionally, with the exercise of public authority, in the cases referred to in points a) to e) and g);
i) the protection of the data subject or of the rights and freedoms of others;
j) the enforcement of civil law claims.
2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions relating at least to
a) the purposes of the processing or categories of processing;
b) the categories of personal data;
c) the extent of the restrictions introduced;
d) safeguards to prevent misuse or unlawful access or transfer;
e) determination of the controller or categories of controller;
f) the applicable retention periods and safeguards, taking into account the nature, scope and purposes of the processing or categories of processing;
(g) the risks to the rights and freedoms of data subjects; and
(h) the right of data subjects to be informed of the restriction, unless this would be contrary to the purpose of the restriction.