1. what is the right to information?
2. information that must be provided
- the purposes of processing;
- the categories of personal data that are processed;
- the recipients or categories of recipients of the data, in particular in the case of recipients in third countries or international organisations;
- if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
- the existence of the rights of rectification, erasure, restriction and opposition to the processing of personal data concerning them;
- the existence of a right of appeal to a supervisory authority;
- any available information on the origin of the data (if the personal data are not collected from the data subject);
- the existence of automated decision-making, including profiling.
Verification of the identity of the data subject:
The identity of the person making the request must be verified in an appropriate manner before the request is processed. If proof is not provided in an appropriate manner, the person concerned must be notified and additional information requested to confirm the identity.
3. deadline
Example:
SeDear Ms / Mr ...,
We have not stored any personal data relating to you. This does not apply to data that you yourself have provided to us in your request for information.
You will find our information on data protection ... (e.g. below, on the reverse, in an attached file or on the website.).
With warm regards,
…
4. what the information process can look like
The controller can provide information about the data processed about the data subjects in a two-step process.
Primary information: In the context of primary information, the person requesting information is informed of all essential data that have arisen in the context of the relationship in a letter. This letter should also contain an overview of the rights of the data subject as well as the indication that further information (especially of a technical nature) can be requested at any time.
Secondary information: If the data subject wants further information, he or she can request secondary information. In this case, data stored in other systems (e.g. data warehouse) relating to the data subject will be identified and processed.
