General Data Protection Regulation (GDPR)
GDPR regulation gives persons affected by the processing of their personal data (‘data subject’) the ability to obtain all information concerning the processing that will be applied to their data.
To do this, the data subject can exercise the following rights:
A. Right of access
Each data subject has a right of access to their data held by CNDS. Before granting access, the data controller will always verify the identity of the person making the access request regardless of who it is.
The data controller will make sure the requested data is provided within one month of receiving the request.
The right of access is in principle free of charge for the data subject unless this represents an excessive burden for Companies in which case payment may be required.
B. Right to revoke consent
All data subjects have the opportunity to withdraw their consent at any time. The withdrawal of consent does not compromise the lawfulness of the processing for which it was originally given.
C. Right to be forgotten / Right to change
Anyone whose personal data has been collected as part of data processing has the possibility, as soon as possible, to have incomplete data completed or to have inaccurate data changed.
Data subjects also have the option of requesting that the data controller delete their data, as soon as possible, when:
- it is no longer required for processing;
- the data subject withdraws their consent (and there is no other justification for the processing);
- the data subject objects to the processing;
- deletion is necessary for compliance with a legal obligation.
D. Right to oppose or limit processing
All data subjects may request that the processing of their data be restricted where:
- the data subject disputes the accuracy of the data concerning them and requests the suspension of the processing to allow the data controller to check the quality of the data;
- the data subject does not want to have their data deleted but simply wants its use restricted;
- the data is obsolete but is required for the data subject to exercise or defend their rights in court.
E. Right to data portability
Data subjects have the right to receive personal data concerning them which they have provided to CNDS in a structured, commonly used and machine-readable format, and they have the right to send this data to another data controller without the data controller to whom the personal data was communicated obstructing this.
CNDS reserves the right, in the event of a manifestly unfounded or excessive request (repeated request, etc.), to refuse to respond to the request. In case of refusal, CNDS undertakes to indicate the reasons for the refusal and the possibilities for appeal to a higher authority.