You can ask an organisation for a copy of the personal information they have about you.
The request may be either oral or written.
Processing time
The organisation must provide you with a copy of your data as soon as possible and no later than 1 month after the request.
In certain circumstances, for example, particularly complicated or many requests, the deadline may be extended by 2 months. In this case, you must be informed:
within 1 month of your request
on why there is a delay
about the right to file a complaint with the Data Protection Authority
Exceptions
Under certain circumstances, an organisation may retain information again, for example, if the information relates to:
scientific study or archiving
prevention or investigation of a crime
national security, defence or public interest
In these cases they are not obliged to inform why information is being retained.
Cost
Access to your data is generally free of charge.
However, an orgnisation may charge administrative costs in certain circumstances, for example if:
you are asking for a lot of information
it takes a lot of time and effort to process your request
request is clearly unfounded or excessive due to repeated
Instructions
You have the right to access the information that is being processed and
confirmation that your personal data is being processed
a copy of the personal data about you that is being processed with
other information about the processing, such as the purpose of the processing, the categories of personal data concerned, the recipients or categories of recipients, the period of time for which the personal data is intended to be stored or the criteria used to decide on this, information on the right to correct, delete, restrict and object, the right to lodge a complaint with the Data Protection Authority, all available information on the source of the information if it comes from someone other than you, and whether automatic decision-making is carried out, including the creation of a profile, and significant information on the reasons behind this, as well as the significance and expected consequences of such processing for you.
Before you send a request for access, you must decide:
Where to send the request
information you want.
If you are not interested in having access to all the personal data that is being processed, you should define the request for access and specify the information you wish to access. This could speed up processing in some cases where the processing of personal data is very extensive.
In general, a request should be accompanied by information on:
Your name and contact details, such as network address, telephone number, home address
Information used by an organisation to distinguish you and other persons with the same name, if any, such as bank number or national identification number
Other information that may be useful for the processing of the request, such as information on the dates or periods covered by the request for access
If there is doubt as to the identity of the person who requests access to personal data, the company or the administrative authority may request that the person concerned provide additional information to confirm their identification.
Companies and institutions need to keep in mind the principle of proportionality in the data protection laws and do not ask for more detailed information or more information than is needed. If additional information is needed, it is desirable to request it as soon as possible.
In an access request, for example, you can request
information on e-mail communications between more specific individuals over a certain period of time
footage from a surveillance camera at a specified location and from a specific date.
Method of personal data transmission
If the request for access is made electronically, the information shall be provided in a commonly used electronic format, unless otherwise requested.
A person may request other forms of communication, such as on paper or to provide information orally, if possible.
If you are thinking of requesting access to personal information about you, which you have previously been given access to, it would be helpful to consider the following:
how likely information has changed since the last access
whether there has been sufficient time since access was granted in the last instance to allow it to be deemed acceptable to request new information on the processing of personal data
whether an organisation has recently changed its operations, as a factor in the processing of personal data
The right of access to personal data does not apply if the vital interests of the individual concerned, including his own, are weighed down. Whether this exemption applies must be assessed in each case. This means, among other things, that:
if the personal data requested also contains personal data about others, it must be assessed every time whether access to them should be granted. The assessment is determined by which interests are the most important.
the nature of personal data may be relevant and whether information is subject to confidentiality or confidentiality obligations.
In some cases, the other persons who are the subject of the information may agree to access. This is not always necessary and depends on the overall assessment of the situation in each case.
If the decision is made to use the above authorization, it is the role of the company or the administrative authority to show that the request is unfounded or excessive.
Access rights not valid
when personal data is processed:
for the purposes of science or history or for statistical purposes
for the purposes of document retention in the public interest and access rights makes it impossible or impedes the achievement of the relevant objectives
Access rights could be limited in the case of:
national security
defence
public safety
preventing, investigating, detecting or prosecuting criminal offences or enforcing criminal penalties, including protecting against and preventing threats to public security
other important objectives of public interest, in particular economic or financial, including foreign exchange, budgetary and fiscal policy, public health and social security
protection of the individual concerned, the urgent public interest or the fundamental rights of others
the satisfaction of civil claims
legal provisions on confidentiality
personal data in working documents used in the preparation of decisions at the company or the administrative authority concerned, and has not been distributed to others, except as necessary to ensure the preparation of the procedure.
information in cases being handled by the government, to the same extent as applies to exceptions to the right to information under information laws and administrative laws.
When access to personal data has been requested more than once
the organisation may refuse to accept a request for access to personal data in certain cases, for example when the request is:
clearly unfounded
in particular for repeated use, and may then be subject to a reasonable charge in relation to the administrative costs of the disclosure.
