UWAGA!

Od 25 maja 2018 r. organem właściwym w zakresie ochrony danych osobowych jest Prezes Urzędu Ochrony Danych Osobowych. Nowa strona internetowa urzędu jest dostępna pod adresem: www.uodo.gov.pl.

Materiały zamieszczone na stronie Generalnego Inspektora Ochrony Danych Osobowych (GIODO) dostępnej pod adresem www.giodo.gov.pl mają charakter archiwalny.

POZOSTAŃ NA STRONIE ARCHIWALNEJ (GIODO)

The right to obtain information

Every person has a right to control the processing of his/her personal data which can be exercised for instance by demanding to obtain information concerning the processing of his/her data.

On the grounds of Article 32 paragraph 1 points 1 to 5a the person has a right to demand - in connection to the processing of personal data - the following information.
  • whether such system exists,
  • who is the controller,
  • since when the personal data have been processed,
  • what is the source of personal data,
  • about the means in which the data are disclosed,
  • about the prerequisites of taking the decision solely based on automated processing of personal data in a computer system (but only if the decision is taken in the course of entering into or performance of a contract and the request lodged by the data subject has been satisfied),
  • informing in the universally understandable way about the data processing.
The data subject may exercise the right to obtain the above mentioned information (excluding the right to determine the prerequisites of taking the decision solely based on automated processing of personal data) once every six months.

In case where data is processed for scientific, didactic, historical, statistical or archival purposes the controller may decide not to notify the data subject about the processing of his/her personal data, if the provision of such information involves disproportionate efforts.

Article 33 of the Act on the Protection of Personal Data imposes the obligation on the controller to notify the data subject about the processing of his/her personal data. The data subject shall lodge a motion in writing in order to get the earlier mentioned information. The controller shell be obliged to notify the data subject within the period of 30 days. At the request of the data subject, the information shall be given in writing.

The controller shall be obliged to notify the data subject about his/her rights and give information - regarding the processing of personal data - referred to Article 32 paragraph 1 points 1 - 5a such as:
  • whether such system exists,
  • who is the data controller (the address of the controller's seat and its full name, and in case the controller is a natural person - his/her address and his/her full name),
  • since when his/her personal data have been processed,
  • what is the source of his/her personal data (unless the controller is obliged to keep it confidential as a state, trade or professional secrecy),
  • information about the means by which the data are disclosed (in particular about the recipients or categories of recipients of the data),
  • information about the prerequisites of taking the decision exclusively as a result of the operations on personal data conducted in the information system,
  • informing in the universally understandable way about the data processing.
Especially the controller is obliged to inform about:
  1. the category of personal data contained in the file,
  2. the means of data collection,
  3. the purpose and the scope of data processing,
  4. the recipients of the data and the scope of access they have been granted.
The controller shall refuse the access to the requested information, only if it would result in:
  1. the disclosure of the information constituting a state secrecy,
  2. pose a threat to national defence or security of the state, human life and health, or security and public order,
  3. pose a threat to fundamental economic or financial interests of the state,
  4. substantial breach of personal interests of the data subjects or other persons.
Article 54 of the Act provides for the criminal liability (a fine, partial restriction of freedom or prison sentence of up to one year) if the controller fails to inform the data subject of its rights or to provide him/her with the information which would enable that person to benefit from the provisions of this Act. In order to pursue the criminal liability it is necessary to refer a case onto the legal way, i.e. the prosecution bodies: Police or prosecutor's office.

Last news