GDPR

Product design Websites Campaigns E-commerce Prototypes Illustrations Merchandise design Corporate design

Wireframing Logotypes Design manuals Packaging design Advertising design UI/UX E-shops

A data subject is any natural person whose personal data is processed, regardless of whether that person is an EU citizen or not. The General Data Protection Regulation grants the data subject several rights that he can exercise directly with the operator (i.e. the entity that processes his personal data).

What are my rights under the General Data Protection Regulation?

Right of access to data

You have the right to request from the person who processes your personal data:

issuing a confirmation as to whether or not your personal data is being processed,
access to your personal data and other information,
providing a copy of the personal data it processes about you.

In the event of a repeated request for a copy, the operator may charge a reasonable fee,an article 15 of the General Data Protection Regulation.

Right to rectification

You have the right to ask the person who processes your personal data to correct your data:

incorrect,
imprecise,
incomplete.

Sample application. More detailed information on the right to access data in an article 16 of the General Data Protection Regulation.

Right to erasure (right to be “forgotten”)

You have the right to request the deletion of your personal data if one of the reasons listed in Art. 17:

for example if the operator no longer needs them, if he processes them illegally, etc.,
an article 17 in paragraph 2 regulates exceptions to this right.

Sample application. More detailed information on the right to erasure in an article 17 of the General Data Protection Regulation.

Right to restriction of processing

You have the right to ask the person who processes your personal data to restrict processing if one of the reasons listed in Art. 18, for example. if you have challenged the correctness of personal data with the operator, etc.
Processing is limited for a certain necessary period, which depends on the specific situation, e.g. until the operator verifies the correctness. Sample application. More detailed information on the right to limit v an article 18 of the General Data Protection Regulation

Right to data portability

This right can be exercised with the operator under the following conditions, which must be met at the same time:

processing is based on consent or contract,
processing is carried out by automated means.

As part of this right, you can:

get your personal data from the operator in a structured, commonly used and machine-readable format,
request the direct provision of your data to another operator.

Sample application. More detailed information on the right to portability in an article 20 of the General Data Protection Regulation, you can also read more information in the Guidelines on the right to portability.

The right to object

You can use the right to object at any time in the following cases:

if your personal data is processed on a legal basis, which is public interest or legitimate interest,
if there is profiling based on public interest or legitimate interest.

Most often, this right is applied when processing personal data for direct marketing purposes, sample request. More detailed information on the right to object in an article 21 of the General Data Protection Regulation.

The right not to be subject to automated individual decision-making, including profiling

You can exercise this right with the person who processes your personal data if you are subject to a decision based solely on automated processing, including profiling, and which has legal effects on you or similarly significantly affects you. Your right includes:

the right to human intervention by the operator,
the right to express your opinion,
the right to challenge such a decision.

Exemptions from this right are listed in Art 22 ods. 2, application form. More details on automated individual decision-making, including profiling in an article 22 of the General Data Protection Regulation. You can read more information in the Guidance on automated individual decision-making and profiling.

The right to file a motion to initiate proceedings on personal data protection

As a data subject, you have the right to submit a proposal to the Personal Data Protection Office of the Slovak Republic to initiate proceedings on personal data protection, you can read more about the proposal to initiate proceedings below.

Right to withdraw consent

If the operator processes your personal data on the basis of consent, you have the right to revoke this consent at any time, you should know how to revoke consent as easily as you granted it, more details about consent in an article 7 of the General Data Protection Regulation, you can read more information in the Consent Guidelines.

How should I proceed in exercising my rights?

you always exercise your rights with the person who processes your personal data, i.e. j. with a specific operator,
if the operator has a responsible person, you can also address your request to this person,
the request can be oral, written, electronic or submitted by other means (the general regulation on data protection does not prescribe a specific form). We recommend using written or electronic form in particular, so that it is possible to demonstrate that you have exercised your right in any personal data protection proceedings,
you need to prepare identification data such as contract number, your ID with the operator, username or password, etc. that is, an identifier on the basis of which the operator will be able to identify you in its environment and thus provide you with data that concern you,
the operator is obliged to process your request without delay and no later than 1 month after its delivery.

What should I do if the operator did not respond or did not comply?

If the operator:

does not respond to your request within 1 month (or an extended period),
he didn’t comply and you think he should have complied,
answered, but you are not satisfied with the operator’s procedure,

you can contact the Office for the Protection of Personal Data of the Slovak Republic and submit a proposal to initiate a procedure for the protection of personal data. A sample of the proposal as well as all the necessary detailed information on the proposal and procedure. It is important to prepare evidence that confirms your claims stated in the proposal (e.g. a copy of the document through which you asserted your rights with the operator, the operator’s response if he responded to you, etc.).

If it is a situation in which you could not exercise your rights, it is necessary to state in the proposal why it was not possible to exercise these rights with the operator.