Council Decision of 13 September 2004 adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2004/644/EC)

SECTION 5 U.K. PROCEDURE FOR DATA SUBJECTS TO EXERCISE THEIR RIGHTS

Article 16 U.K. General provisions

1. The data subjects’ rights specified in this Section can only be exercised by the individuals concerned or, in exceptional cases, on behalf of the individuals with proper authorisation. Requests shall be addressed in writing to the controller concerned with a copy to the DPO. If necessary, the DPO shall assist the data subject in identifying the controller concerned. The DPO shall make specific forms available. Controllers shall grant the request only if the form has been filled in completely and the complainant's identity has been verified properly. The exercise by data subjects of their rights shall be free of charge.

2. The controller shall send to the applicant an acknowledgement of receipt within five working days from the registration of the application. Unless otherwise provided, the controller shall reply to the request at the latest within fifteen working days from the registration of the request and shall either give satisfaction or state in writing the reasons for the total or partial refusal, in particular in cases where the applicant is not considered as data subject.

3. In case of irregularities or obvious misuse by the data subject in exercising his/her rights and where the processing is alleged to be unlawful by the data subject, the controller must consult the DPO on the request and/or refer the data subject to the DPO, who will decide on the eligibility of the request and the appropriate follow-up to be given.

4. Any person concerned may consult the DPO with regard to the exercise of his/her rights in a specific case. Without prejudice to any judicial remedy, every data subject may lodge a complaint with the EDPS, if he/she considers that his/her rights under the Regulation have been infringed as a result of the processing of his/her personal data.

Article 17 U.K. Right of access

The data subject shall have the right to obtain from the controller, without constraint, at any time within three months from the receipt of the request, the information referred to in points (a) to (d) of Article 13 of the Regulation, either by consulting these data on the spot, or by receiving a copy, including, where appropriate, a copy in an electronic form, according to the applicant's preference.

Article 18 U.K. Right of rectification

Each data subject’s request for the rectification of inaccurate or incomplete personal data shall specify the data concerned as well as the rectification to be made. It shall be dealt with by the controller without delay.

Article 19 U.K. Right of blocking

The controller shall treat any request for the blocking of data under Article 15 of the Regulation without delay. The request shall specify the data concerned as well as the reasons for blocking them. The controller shall inform the data subject who made the request before the data are unblocked.

Article 20 U.K. Right of erasure

The data subject may request the controller to erase data without delay in case of unlawful processing, particularly where the provisions of Articles 4 to 10 of the Regulation have been infringed. The request shall specify the data concerned and shall provide the reasons or evidence of the unlawfulness of the processing. In automated filing systems, erasure shall in principle be ensured by all appropriate technical means, excluding the possibility of any further processing of the erased data. If erasure is not possible for technical reasons, the controller, after consultation of the DPO and of the interested person, shall proceed to the immediate blocking of such data.

Article 21 U.K. Notification to third parties

In case of any rectification, blocking or erasure following a request made by the data subject, he/she may obtain from the controller the notification to third parties to whom his/her personal data have been disclosed, unless this proves impossible or involves a disproportionate effort.

Article 22 U.K. Right to object

The data subject may object to the processing of data relating to him/her and to the disclosure or use of his/her personal data, in conformity with Article 18 of the Regulation. The request shall specify the data concerned and shall provide the reasons justifying the request. Where the objection is justified, the processing in question shall no longer involve those data.

Article 23 U.K. Automated individual decisions

The data subject is entitled not to be the subject of automated individual decisions as intended by Article 19 of the Regulation, unless the decision is explicitly authorised pursuant to national or Community legislation, or by an EDPS decision safeguarding the data subject's legitimate interests. In either case, the data subject shall have the opportunity to make known his or her point of view in advance and to consult the DPO.

Article 24 U.K. Exceptions and restrictions

1. To the extent that legitimate reasons as specified in Article 20 of the Regulation clearly justify it, the controller may restrict the rights referred to in Articles 17 to 21 of this Decision. Except in case of absolute necessity, the controller shall first consult the DPO, whose opinion shall not bind the Institution. The controller shall reply to requests relating to the application of exceptions or restrictions to the exercise of rights without delay and shall substantiate this decision.

2. Any person concerned may request the EDPS to apply Article 47(1)(c) of the Regulation.