Every data subject is entitled to obtain free of charge from the controller upon his written request:
confirmation whether or not his personal data are being processed, information on the purposes of processing, the categories of processed data and the recipients or categories of recipients to whom personal data are disclosed;
communication to him in a comprehensible form of the data undergoing processing and of any available information as to their source; in case of automated decisions taken based on Article 14 herein, information about the logic applied in the decision-making;
Tthe information about the data shall be communicated in the form they were at the time when the request was made.
Within 30 days upon receipt of the request, the controller informs the data subject or explains the reasons why the information cannot be provided.
The right to access, as provided for in section 1 herein, shall be exercised in respect of the constitutional principles of freedom of speech and information, freedom of press and professional confidentiality and it may be restricted if it violates national security interests, the foreign policy, the economic and financial interests of the state, prevention and prosecution of criminal offences.
The right to access cannot be exercised in cases provided for in Article 10 (1) herein.
If access is denied on arguments of violation of national security interests, foreign policy, economic and financial interests of the state, prevention and prosecution of criminal offences or of the freedom of speech and information or press freedom, the data subject may require from the Commissioner to check on the exemption for the concrete case. The Commissioner shall inform the data subject about the undertaken measures.
Every data subject has the right to request blocking, rectification or erasure of his data, free of charge whenever he is informed that data relating to him are irregular, untrue, and incomplete or have been processed and collected in contradiction with the provisions of this law.
Within 30 days from receipt of the data subject request, the controller shall notify the data subject on the lawful processing of the data, whether the blocking, rectification or erasure has been carried out or not.
When the controller does not carry out the blocking, rectification or erasure of the data requested, the data subject has the right to file a complaint with the Commissioner.
Each person shall be entitled not to be subject to decisions, that cause legal effects on him or that influence him significantly and the decision is based only on the automatic processing of the data, which aim at assessing certain personal aspects related to him, particularly his efficiency at work, his credibility or behavior.
A person may be subject to a decision taken under point 1 herein, when the decision:
(a) is taken in the course of entering into or performance of a contract, provided the request for entering into or the performance of the contract, lodged by the data subject, has been satisfied, or if there are adequate measures to safe-guard his legitimate interests, such as the possibilities allowing him to point out his views;
(b) is authorized by a law which also lays down measures to safeguard the data subject’s legitimate interests.
The data subject, pursuant to the law, has the right to object, at any time, free of charge the processing of data related to him carried out under letter “d” and “dh” of article 6 of this Law, unless otherwise stipulated by the law. The data subject has the right to demand the controller not to start processing, or if processing has started, to stop processing of personal data related to him for the purposes of direct marketing and to be informed in advance before personal data are disclosed for first time for such purpose.
Every person who claims that his rights, freedoms and legal interests concerning his personal data have been violated shall have the right to complain or to notify the Commissioner and to request his intervention to remedy the infringed right. Following this complaint, in accordance with the Code of Civil Procedure, the data subject may file a complaint in court.
When the data subject has filed a complaint, the controller shall have no right to make any changes to the personal data until a final decision ruled.
Everyone who has suffered damage due to an un-lawful processing of personal data is entitled to compensation, pursuant to the rules defined by the Civil Code.
