Advice of rights under GDPR:
Under Article 13-14 of the GDPR:
- I have the right to the provision of the information where personal data are collected from the data subject as well as where personal data have not been obtained from data subject.
Under Article 15 of the GDPR – Right to access to My Personal Data:
- I have the right to obtain from the Controller confirmation as to whether or not My Personal Data are being processed and, if so access My Personal Data and the following information: a) the purposes of processing; b) categories of affected personal data c) recipients or the categories of recipients, to whom My Personal Data have been or will be disclosed, in particular recipients in third countries or international organisations; d) the planned period, during which My Personal Data will be stored or, if it is not possible to determine it, the criteria to determine this period e) the existence of the right to request from the Controller the rectification or erasure of My Personal Data or restriction of their processing and/or to object to this processing;
- I have the right to file a complaint with the supervisory authority;
- I have the right to obtain all available information on the source of My Personal Data if not acquired directly from me; the existence the automated decision-making occurs, including profiling, specified in the Article No. 22, par. 1 and 4 of the GDPR and at least in these cases the meaningful information related to the procedure used as well as the meaning and expected results of such processing for me.
- I have the right to the provision of the copy of My Personal Data processed by the Controller. The Controller may charge a reasonable fee for any further copies requested by me based on administrative costs. If I make the application in electronic form, the information will be provided in a commonly used electronic form, unless I request another method.
Under Article 16 of the GDPR – Right to rectification of My Personal Data:
- I have the right to rectification on the part of the Controller of inaccurate personal data concerning me without undue delay. Considering the processing purposes, I have the right for the completion of incomplete details even by providing a supplementary statement.
Under Article 17 of the GDPR – Right to erasure of My Personal Data:
- I have the right to erasure on the part of the Controller of My Personal Data without undue delay for one of the following reasons:
a) My Personal Data are no longer required for the purposes for which they have been collected or otherwise processed;
b) I have objected to the processing under Article 21, par. 1 of the GDPR, and there are no prevailing reasons for processing, or I have objected to the processing under Art. 21, par. 2 of the GDPR;
c) My Personal Data have been unlawfully processed;
d) My Personal Data have to be erased to comply with a legal obligation in the law of the European Union or a Member State to which the Controller is subject.
- what is specified under clause a) through d) of this section will not apply if the processing of My Personal Data is necessary:
a) for exercising the right to freedom of speech and information;
b) for compliance with the legal obligation that requires the processing by the law of the European Union or a Member State, to which the Controller is subject , or for the performance of the task carried out in the public interest or in the scope of a public authority if the Controller has been authorised by it;
c) for reasons of the public interest in the field of the public health;
d) for archiving purposes in the public interest, for the purpose of scientific or historical research or for statistical purposes in compliance with Art. 89, par. 1 of the GDPR; or
e) for the specification, performance or defence of legal claims.
Under Article 18 of the GDPR – Right to restriction of the processing of My Personal Data:
- I have the right to restriction on the part of the Controller of processing where one of the following applies:
a) If I contest the accuracy of My Personal Data for a period enabling the Controller to verify the accuracy of My Personal Data;
b) If processing is unlawful and I would oppose the erasure of My Personal Data and request the restriction of their use instead;
c) If the Controller no longer needs My Personal Data for the processing purposes, but I would require them for the establishment, exercise or defence of legal claims;
d) If I have objected to processing under Article 21, section 1 of the GDPR, pending the verification whether the legitimate grounds of the Controller prevail over mine.
- If the processing has been restricted under clauses a) through d) of this paragraph, My Personal Data, with the exception of their storage, may only be processed with my consent or due to the establishment, exercise or defence of legal claims, for the protection of rights of another individual or a legal entity or for reasons of important public interest of the European Union or of a Member States.
Under Article 19 of the GDPR – Notification obligation regarding rectification or erasure of My Personal Data or restriction of their processing:
- The Controller advises individual recipients to whom My Personal Data have been disclosed of any rectifications or erasure of My Personal Data or processing restrictions, unless this proves impossible or involves unreasonable effort. The Controller only informs me about these recipients if I request it.
Under Article 20 of the GDPR – Right to data portability:
- I have the right to obtain the personal data concerning me, which I have provided to the Controller, in a structured, commonly used and machine-readable format and I have the right to transfer these data to another controller without hindrance from Controller, provided their processing is carried out in by automated means. In exercising my right to portability under the previous sentence, I have the right to have My Personal Data transmitted directly from the Controller to another controller, where technically feasible.
Under Article 21 of the GDPR – Right to object:
- I have the right to object, on the grounds relating to my particular situation, at any time to the processing of My Personal Data, under Article 6, par. 1, clause f) of the GDPR – the Controller’s legitimate interest, including profiling based on these provisions. The Controller will no longer process My Personal Data unless the Controller demonstrates compelling legitimate reasons for the processing that outweigh my interests or rights and freedoms or for the establishment, exercise or defence of legal claims.
- I can exercise my right to object by automated means through technical specifications.
Under Article 22 of the GDPR – Automated individual decision-making, including profiling:
I have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal impacts on me or affects me in a material way. This does not apply if the decision:
a) is necessary to enter into or perform a contract between me and the Controller;
b) is permitted by the law of the EU or a Member State applicable to which the Controller is subject and which also determines suitable measures to safeguard my rights and freedoms and legitimate interests;
c) based on may express consent.
Under Article 34 of the GDPR – Communication of a personal data breach
If it is likely that a specific instance of a security breach of My Personal Data will result in a considerable threat to my rights and freedoms, the Controller is required to report this breach to me without any undue delay.
However, the reporting referred to in this paragraph is not required if any of the following conditions are met:
a) The Controller has introduced appropriate technical and organisational measures, and these measures have been applied to the personal data affected by the personal data breach, in particular measures that render these data unintelligible to anyone who is not authorised to access them, such as encryption;
b) The Controller has taken subsequent measures that ensure that no considerable threat to the rights and freedoms referred to in the first paragraph of this article is likely to materialise;
- It would involve unreasonable effort. In this case, you will be advised in an equally effective manner by a public notice or similar means. Filing a complaint with the Office for Personal Data Protection means that you have the right to file a complaint related to personal data processing by the Controller with the Office for Personal Data Protection with its registered office at Pplk. Sochora 27, 170 00 Praha 7. Website of the Office: www.uoou.cz.