What are the rights of the data subject?
This matter is regulated by the provisions of the chapter 4 of the Act of August 29, 1997 on the Protection of Personal Data (unified text: Journal of Laws of 2002, No. 101, item 926 with later amendments), hereinafter called the Act (Art. 32 - 35).
On the ground of the provisions of Art. 32 every person, who is a data subject has a right to obtain:
- extensive information on whether the data is being processed in the existing filing systems,
- what is the purpose, scope and the means of processing of the data,
- from what source the personal data has been obtained (unless the controller is obliged to keep it confidential as a state, trade or professional secrecy),
- information about the recipients of data.
The data subject has a right to turn to the controller with such a demand not more often than once every 6 months. At the request of the data subject, within the period of 30 days, the controller shall be obliged to notify the data subject about his/hers rights. The controller may not notify the subject about the processing of his/her data when it is processed for scientific, didactic, historical, statistical or archival purposes or when the provision of such information involves disproportionate efforts (Art. 32 paragraph 4).
The data subject has also the right to turn to the controller with a demand to complete, change, update, rectify the earlier mentioned data.
If the data is being processed under the provisions of Article 23 point 4 and 5 of the Act and the justified prerequisites have taken place (that is: the controller plans to process the data for marketing purposes or transfers the data to other controllers), the data subject has a right to make a justified demand in writing for the blocking of the processing of his/her data due to his/her particular situation.
- In this case the controller shall immediately stop the processing of the questioned data or without delay transmit the demand to the Inspector General for Personal Data Protection who shall make an appropriate decision.
In cases referred to in Article 23 points 4 and 5 the data subject has also a right to object to the further processing of his/her data if the controller intends to process the data for marketing purposes or to object to the transfer of data to another controller.
- The above mentioned objection causes that the further processing of the questioned data shall be prohibited, however the controller is allowed to leave in the filing system forenames, surnames, PESEL identification number or the address in order to avoid the data being used once more.
The data subject has also a right to turn to the Inspector General any time with the request to issue the relevant order to the controller to stop the processing of the questioned data or to remove it from the data filing system (Art. 35 paragraph 1).


