Article 18
Personal Data Subject's Rights in Relation to the Controller
The data subject has the right to obtain from the controller, in relation to his data processed by the controller, at any time and upon request:
- I - confirmation of the existence of processing;
- II - access to data;
- III - correction of incomplete, inaccurate or outdated data;
- IV - anonymization, blocking or deletion of unnecessary, excessive or processed data in violation of the provisions of this Law;
- V - portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority, subject to commercial and industrial secrets;
- VI - deletion of personal data processed with the consent of the data subject, except in the cases provided for in art. 16 of this Law;
- VII - information on public and private entities with which the controller made shared use of data;
- VIII - information about the possibility of not giving consent and about the consequences of the refusal;
- IX - revocation of consent, pursuant to § 5 of art. 8 of this Law.
- 1. The data subject has the right to petition regarding his data against the controller before the national authority.
- 2. The data subject may oppose processing based on one of the hypotheses of waiver of consent, in case of non-compliance with the provisions of this Law.
- 3. The rights provided for in this article shall be exercised upon the express request of the data subject or legally constituted representative to the processing agent.
- 4. In the event of impossibility of immediate adoption of the measure referred to in § 3 of this article, the controller shall send the data subject an answer in which he may:
- I - communicate that he is not a data processing agent and indicate, whenever possible, the agent; or
- II - indicate the reasons of fact or law that prevent the immediate adoption of the measure.
- 5. The request referred to in § 3 of this article shall be met at no cost to the data subject, within the time limits and under the terms provided for in the regulation.
- 6. The responsible person shall immediately inform the processing agents with whom he has made shared use of data the correction, deletion, anonymization or blocking of the data, so that they repeat the same procedure. This provision does not apply in cases that the communication is manifestly impossible or result of a desproportional effort.
- 7. The portability of the personal data referred to in item V of the caput of this article does not include data that has already been anonymized by the controller.
- 8. The right referred to in § 1 of this article may also be exercised before consumer protection organizations.