As a data subject, you have the right to obtain confirmation from the controller as to whether personal data concerning you is being processed.
If the controller processes your personal data, you have the right to access that data and obtain additional information about:
- the purpose of the processing of your personal data;
- the categories of personal data being processed,
- the recipients or categories of recipients to whom your personal data has been or will be disclosed, in particular recipients in third countries or international organizations, where possible; if the personal data is transferred to a third country or an international organization, you have the right to be informed of the appropriate safeguards required by law,
- the period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period,
- your right to request the rectification, erasure, or restriction of the processing of your personal data, or your right to object to the processing, as well as your right to initiate data protection proceedings,
- the source of the personal data, if the personal data was not obtained directly from you,
- the existence of automated individual decision-making, including profiling (for example: “Certain organizations, such as banks, tax authorities, and hospitals, use algorithms to make decisions about you based on your personal data. While this is efficient for them, it is not always transparent, and such decisions may have legal or other significant effects on your life” (see also: the EU Guide for Citizens on Personal Data Protection). Profiling means any form of automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to an individual, in particular aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements).
In such cases, the controller shall provide the data subject with information, in particular, about the procedure used, as well as the significance and the envisaged consequences of such processing for the data subject.
The controller is required to provide you with the personal data it processes about you. For repeated requests for copies of personal data, the controller may charge a reasonable fee corresponding to the administrative costs incurred. The controller is obliged to provide your personal data in the manner requested by you.
The right to obtain personal data must not adversely affect the rights and freedoms of other natural persons.
