Informative Notes: What is a request for access to personal data?
The General Data Protection Regulation (EU) 2016/679 entitles the data subject to access the personal data processed by the controller, CTC-ARI. This form is used for the exercise of this right.
- Data Subjects have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR.
- Data Subjects have the right to access their personal data. This is commonly referred to as subject access.
- Data Subjects have the right to have inaccurate personal data rectified or completed if it is incomplete. In certain circumstances CTC-ARI can refuse a request for rectification.
- Data Subjects have the right to have their Personal Data erased. The right to erasure is also known as ‘the right to be forgotten’. The right is not absolute and only applies in certain circumstances. This right is not the only way in which the GDPR places an obligation on you to consider whether to delete Personal Data. Personal Data might be necessary to be deleted as per the retention period defined in each process.
- Data Subjects have the right to request the restriction or suppression of their Personal Data. This is not an absolute right and only applies in certain circumstances. When processing is restricted, you are permitted to store the Personal Data, but not use it.
- Data Subjects have the right to restriction to data portability. This allows the subject to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability. Doing this enables individuals to take advantage of applications and services that can use this data to find them a better deal or help them understand their spending habits. The right only applies to information an individual has provided to CTC-ARI.
- Data Subjects have the right to object to the processing of their personal data in certain circumstances. Individuals have an absolute right to stop their data being used for direct marketing. In other cases where the right to object applies, CTC-ARI may still be able to continue processing if it can show that it has a compelling reason for doing so.
- The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Individuals can make a subject access request verbally or in writing but in both cases the request will be documented and the identity of the requestor shall be checked. In general, and unless otherwise notified, there is no fee for exercising a data subject’s right. CTC-ARI Airports Ltd has 30 days to respond to a valid request after it has verified the identity of the requestor.
The forms will be stored in a secure cabinet for proof of request for a maximum of 3 years from the request date.