It shall be necessary to identify the petitioner or applicant by means of recognised electronic signature systems or, where appropriate, by the personal appearance before the public official of the data subject or by his/her duly accredited representative.
The application must include the address of the data subject for notification purposes. Likewise other supplementary information may be included such as your email address should you wish to receive information as regards your personal data via this medium.
In order to enable the proper exercise of these rights, it shall be necessary to include the information that the data subject considers useful for the purposes of facilitating the search for the documentation wherein included is the personal data to which your application makes reference to.
The responsible body shall furnish the data subject with information as regards its actions on the basis of the data subjects application within one month from receipt of the application. Said period may be extended by a further two months where necessary, taking into account the complexity and number of applications. The responsible body shall notify the data subject of any such extension within one month of receipt of the application, specifying the grounds for the delay. Where the data subject submits the application via electronic means, the information shall be furnished via electronic means whenever possible, unless the data subject requests otherwise.
The data subject shall have the right to obtain from the data controller, confirmation as to whether or not his/her personal data are being processed. And where that is the case, furnish the following information: who retains same personal data, what personal data is retained, available information as the source of said personal data, what are the purposes of the personal data processing, the period envisaged for the processing thereof, the recipients or categories of recipients to whom the personal data have been or shall be disclosed, the existence of automated decision as well as the envisaged consequences of such processing for the data subject including the creation of profiles. Where personal data are the subject of an international assignment, you as the data subject shall have the right to be notified of the appropriate safeguards that this entails.
You shall likewise notified of the option of exercising the rights of rectification, erasure, limitation or opposition, as well as the right to file a complaint with the Spanish Data Protection Agency.
The data controller shall furnish a copy of the personal data being processed to the data subject.
This right of access is separate right to that of the right of access to public information regulated by Law 19/2013, of 9 December, on Transparency, Access to Public Information and Good Governance. It is likewise a separate right to that of the right of access to documentation in an administrative procedure when one holds the status of data subject, governed by Law 39/2015 of 1 October on Common Administrative Procedure of Public Administrations. Access to medical records is governed by Law 41/2002, of 14 November, regulating patient autonomy and rights and obligations of information and clinical documentation.
The data subject shall have a right to obtain from the data controller the rectification of his/her personal data, in the event of being inaccurate or incomplete. It shall be necessary to specify which data that reference is made to, the rectification which must be carried out, and enclosed thereto, the application of the substantiating documentation of that which has been requested.The data controller shall notify any rectification of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or entails a disproportionate effort. The data controller shall notify the data subject as regards those recipients if the data subject so requests.
& This is the right of erasure of personal data concerning the data subject. The data subject may request the erasure of his/her personal data in the following cases: when the personal data are no longer necessary in relation to the purposes for which same were collected or otherwise processed; the data subject has withdrawn consent on which the processing is based; the data subject objects to the processing; the personal data has been unlawfully processed; the personal data must be erased for compliance with a legal obligation; the personal data have been obtained in relation to the offer of information society services, in particular if the data subject is under 14 years of age
Nevertheless, the subsequent retention of personal data must be lawful to the extent that processing is required for exercising the right of freedom of expression and information; for compliance of a legal obligation; for the performance of a task carried out in the public interest or in the exercise of official authority vest in the data controller; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; or for the establishment, exercise or defense of legal claims.
In order to strengthen the right to be forgotten in the online environment, the right to erasure should likewise be extended in such a way that a data controller who has made the personal data public must be obliged to notify the data controllers processing such personal data to erase any link thereto, or copies or replications of said personnel data.
The data controller shall notify any erasure of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or entails a disproportionate effort. The data controller shall notify the data subject as regards those recipients if the data subject so requests.
In exercising this right, the data subject may request the erasure of the processing of his/her personal data when he/she has challenged the accuracy of said data and for a period enabling the data controller to verify the accuracy thereof; or when the data subject has opposed the processing whilst it is verified whether the legitimate reasons of the data controller prevail over his/her rights.
Likewise the right to retain the personal data may be requested when the processing is unlawful and the data subject opposes the deletion of the personal data and requests instead the restriction of the use thereof; or when the data controller no longer requires the personal data for the purposes of the processing but the data subject requires same for the establishment, exercise or defense of legal claims.
The data controller shall notify any limitation of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or entails a disproportionate effort. The data controller shall notify the data subject as regards those recipients, if the data subject so requests.
Furthermore, the data subject in exercising his/her right to data portability shall have the right to have the personal data transmitted directly from one data controller to another, where technically feasible.
The data subject shall have the right to object, on grounds relating to his/her particular situation, at any time to the processing of his/her personal data or the further processing thereof. The data controller shall no longer process the personal data, unless the controller demonstrates compelling legal grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.
Where personal data are processed for direct marketing processes, the data subject shall have the right to object at any time to processing of his/her of personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for said purpose.
In the context of the use of information society services, the data subject may exercise his/her right to object by automated means using technical specifications.
Where personal data are processed for scientific or historical research or statistical purposes, the data subject shall have the right, on grounds relating to his or her particular situation, shall have the right to object to the processing of his/her personal data, unless the processing is necessary for the performance of a task carried out for reasons of public interest. .
Any natural person over fourteen years old; in relation to his/her personal data whose processing is carried out by a local body which shall be specified.
Further information at: https://www.aepd.es/
