EU GDPR | Art. 12
Rights Of The Data Subject
These rights are pivotal under the GDPR and important to note as they carry a huge amount of weight in determining whether personal data is processed in a fair, lawful and transparent way. It also why we’re mentioning the legislation by way of the Articles of the GDPR as each interacts with, and in places mentions the other.
The rights of the data subject are vitally important when considering any privacy policy, privacy notice or notice of fair processing.
Article 12
(1) The controller shall take appropriate measures to provide any information relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
(2) The controller shall facilitate the exercise of data subject rights. The controller shall not refuse to act on the request of the data subject for exercising his or her rights, unless the controller demonstrates that it is not in a position to identify the data subject.
(3) The controller shall provide information on action taken on a request to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
(4) If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
(5) Information provided and any communication and any actions taken shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
a. charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
b. refuse to act on the request.
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
(6) Without prejudice, where the controller has reasonable doubts concerning the identity of the natural person making the request the controller may request the provision of additional information necessary to confirm the identity of the data subject.
The following Articles highlight the other Data Subjects Rights including how to receive a copy of the personal data being processed, the right of rectification and erasure; right to object and automated decision making and restrictions.