Directive (EU) 2019/520 of the European Parliament and of the CouncilShow full title

Article 27 Data protection

1. Regulation (EU) 2016/679 and the national laws, regulations or administrative provisions transposing Directives 2002/58/EC and (EU) 2016/680 shall apply to personal data processed under this Directive.

2. Member States shall, in accordance with applicable data protection legislation, take the measures necessary, to ensure that:

(a) the processing of personal data for the purposes of Articles 23, 24 and 25 is limited to the types of data listed in Annex I to this Directive;

(b) personal data are accurate, kept up-to date and requests for rectification or erasure are handled without undue delay; and

(c) a time limit is established for the storage of personal data.

Member States shall take the measures necessary to ensure that personal data processed under this Directive are used only for the purposes of:

(a)

identification of suspected offenders in view of the obligation to pay road fees within the scope of Article 5(8);

(b)

ensuring the compliance of the toll charger as regards its obligations to tax authorities within the scope of Article 5(9); and

(c)

identification of the vehicle and the owner or holder of the vehicle for which a failure to pay a road fee has been established within the scope of Articles 23 and 24.

Member States shall also take the measures necessary to ensure that the data subjects have the same rights of information, access, rectification, erasure and restriction of processing, and to lodge a complaint with a data protection supervisory authority, compensation and an effective judicial remedy as provided for in Regulation (EU) 2016/679 or, where applicable, Directive (EU) 2016/680.

3. This Article shall not affect the possibility of Member States to restrict the scope of the obligations and rights provided for in certain provisions of Regulation (EU) 2016/679 in accordance with Article 23 of that Regulation for the purposes listed in the first paragraph of that Article.

4. Any person concerned shall have the right to obtain, without undue delay, information on which personal data recorded in the Member State of registration were transmitted to the Member State in which there was a failure to pay a road fee, including the date of the request and the competent authority of the Member State in whose territory there was a failure to pay a road fee.