The personal data subject has the right to obtain the following from the controller, regarding the data subject’s data being processed by the controller, at any time and by means of request:
I –confirmation of the existence of the processing;
II –access to the data;
III –correction of incomplete, inaccurate or out-of-date data;
IV –anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of this Law;
V –portability of the data to another service or product provider, by means of an express request and subject to commercial and industrial secrecy, pursuant to the regulation of the controlling agency;
VI –deletion of personal data processed with the consent of the data subject, except in the situations provided in Art. 16 of this Law;
VII –information about public and private entities with which the controller has shared data;
VIII –information about the possibility of denying consent and the consequences of such denial;
IX –revocation of consent as provided in §5 of Art. 8 of this Law.
§1The personal data subject has the right to petition, regarding her/his data, against the controller before the national authority.
§2The data subject may oppose the processing carried out based on one of the situations of waiver of consent, if there is noncompliance with the provisions of this Law.
§3The rights provided in this article shall be exercised by means of express request by the data subject or her/his legally constituted representative to the processing agent.
§4If it is impossible to immediately adopt the measure mentioned in §3 of this article, the controller shall send a reply to the data subject in which she/he may:
I –communicate that she/he is not the data processing agent and indicate, whenever possible, who the agent is; or
II –indicate the reasons of fact or of law that prevent the immediate adoption of the measure.
§5The request as mentioned in §3 of this article shall be fulfilled without costs to the data subject, within the time periods and under the terms as provided in regulation.
§6The responsible shall immediately inform the processing agents with which she/he has carried out the shared use of data of the correction, deletion, anonymization or blocking of data, so that they can repeat an identical procedure.
§7The portability of personal data referred to in Item V of the lead sentence of this article does not include data that have already been anonymized by the controller.
§8The right referred to in §1 of this article may also be exercised before consumer-defense entities.