Personal data protection rights

The right to limit processing can be exercised when any of the following requirements is met:

1. the data subject challenges the accuracy of the personal information, until such time as the Senate verifies its accuracy.
2. the processing is unauthorized and the data subject opposes the elimination of his or her personal information and instead requests that its use be limited.
3. the Senate no longer needs the personal information for processing purposes, but the data subject needs it to lodge, exercise or defend a complaint.
4. the data subject has opposed processing, until such time as the legitimate grounds of the data controller are confirmed to prevail over those of the data subject.

Where the Senate has agreed to limit processing, the personal information affected may only be processed with the consent of the data subject or for the preparation the preparation, exercise or defence of complaints, or with a view to protecting the rights of another natural or legal person or for reasons of public interest.

If the processing limitation is subsequently to be lifted, the Senate will inform the data subject in advance.

The right of elimination is aimed at the removal, without undue delay, of the personal information when its processing is not legitimate or the reason giving rise to its processing has disappeared. There are exceptions that warrant not complying with this request, for example, when the freedom of expression or freedom of information must prevail, the fulfilment of a legal obligation, the preparation, exercise or defence of complaints, or for the purposes of archiving, investigation or statistical analysis.

In particular, data subjects will be able to request the elimination of information concerning them when any of the following circumstances apply:

1. the personal information is no longer needed for the purposes for which it was collected or otherwise processed;
2. the data subject has withdrawn the consent on which the processing was based, and there is no other legal basis for processing;
3. the data subject opposes processing and there are no prevailing legal grounds for processing their information;
4. the personal details have been processed illegally;
5. the personal information must be eliminated for the fulfilment of a legal obligation applicable to the data controller.

If the Senate has published personal information and is obliged to respond to an elimination request, it will adopt reasonable measures, bearing in mind the technology available and the cost of applying it, in order to inform third parties processing the personal information in question of their obligation to eliminate any links, copies or replicas of the same.

This right enables data subjects to receive their personal information provided to the Senate in a widely-used structured format suitable for machine reading, and to be able to transmit the information directly to another data controller, provided that this is technically feasible and, in addition, does not negatively affect the rights and freedoms of other people.

This right will have little room for application in the Senate as it only makes sense when the processing is based on consent or in a contract and, in addition, processing is carried out by automatic means.

Not applicable to the habitual processing performed at the Senate, where the legal authority is the fulfilment of a mission undertaken in the public interest or in the exercise of public powers.

The recognition and effects of the same shall not hinder the exercise of the right of elimination.

The right of opposition is exercised by data subjects to ensure no processing is carried out, or ceases to be carried out, with their personal details. The right of opposition can be exercised at any time for reasons related to the particular situation of the data subject, when their personal information is processed on the basis of the exercise of public powers.

In such cases, having regard for the individual situation alleged by the person concerned, the Senate will cease to process his or her data and, in particular, to provide public access to them, unless it can show a legitimate mandatory reason for doing so or it is necessary for the exercise or defence of a complaint.

Furthermore, this right can be exercised when the processing is intended for scientific or historical research or for statistical purposes, for reasons related to the individual’s situation, unless the processing is necessary for the fulfilment of a mission entrusted for reasons of public interest.

By exercising this right, persons affected by processing can find out whether their personal details are being processed by the Senate, what details are being processed, the purpose of that processing, the source of their information and whether they have been or will be transferred to any third parties.

The Senate will inform data subjects about the following contents:

1. the purposes of processing;
2. the categories of personal data involved;
3. the intended recipients or categories of intended recipients or to whom their personal data have been or will be communicated;
4. where possible, the retention times for personal details or, where this is not feasible, the criteria used to determine this deadline;
5. the existence of the right to request from the data controller the correction or elimination of their personal information or request the limitation of the processing of their personal details, or to oppose such processing;
6. the right to lodge a complaint before a supervisory authority;
7. when the personal details have not been obtained from the data subject, any information available regarding their provenance;
8. the existence of automated decisions, including the preparation of profiles and, at least in such cases, significant information about the logic applied, as well as the impact and the consequences foreseen for the data subject as a result of such processing.

The Senate will provide data subjects with a copy of the personal details being processed, provided that this does not negatively affect the rights and freedoms of others.

Through the exercise of this right before the data controller, the data subject is entitled to obtain the amendment of any inaccurate or incomplete personal details without undue delay, with the obligation to set out in the request which details are to be corrected or altered.

Any such request must be accompanied by documentation accrediting the accuracy of the correction requested.