Title II – Rights of the data subject

Art. 7. Rights of the data subject

1. The data subject has the right to obtain confirmation of the existence of personal information concerning him or her, even if not yet registered, and to the communication of that information in an intelligible form.
2. The data subject may obtain details of:
a) the origin of the personal information;
b) the purpose and method of treatment;
c) the method used if the data is processed electronically;
d) the details of the data controller, data coordinator and the authorized representative as defined in Article 5(2);
e) the persons or categories of person to whom the personal details may be disclosed or who may be made aware of them as the authorized representative or data coordinator within State territory.
3. The data subject may:
a) ask for the details to be updated, amended or integrated where necessary;
b) the deletion, transformation into an anonymous form or blocking of data processed in breach of the law, including any information that is no longer required for the purpose for which it was obtained or used;
c) confirmation that the operations in a) and b) and their content have been made known to those persons to whom the information was disclosed, except where the fulfilment of this obligation is impossible or entails a use of resources that is manifestly disproportionate to the right being protected.
4. The data subject may object, in full or in part:
a) for legitimate reasons, to the use of personal information concerning him or her, even if it is relevant to the purpose of collection;
b) the use of his or her personal information for the purpose of sending advertising or direct selling materials, or for the carrying out of market research and promotional communications.