Art. 7 Right of access to personal data and other rights
1. The data subject (party concerned) is entitled to obtain confirmation regarding the existence or otherwise of personal data regarding self, even if such data are not yet registered, and to receive the said data in intelligible form.
2. The data subject is entitled to receive information regarding:
a) the origin of the personal data;
b) the purposes for which the data are being handled and the methods adopted; c) the logics applied in the event that the data are handled with the use of electronic equipment;
d) details identifying the data controller, the data processing supervisors and the appointed representative as envisaged in article 5, paragraph 2
e) the subjects or the categories of subject to whom the personal data may be transferred or to whose attention they may be brought in a capacity as appointed representative for the territory of the State in question, as data processing supervisors or data processors.
3. The data subject is entitled:
a) to have data up-dated, altered or, when in his or her interests, supplemented;
b) to have data handled in contravention of the law deleted, rendered anonymous or the circulation thereof restricted, including any information that need not be kept in relation to the purposes for which the data was collected or subsequently handled;
c) to obtain confirmation that the measures referred to in the foregoing paragraphs a) and b), including details thereof, have been brought to the attention of the parties to whom the data have been transferred or disseminated, unless such an obligation proves impossible or would require means which are grossly disproportionate to the rights being protected.
4. The data subject is entitled to oppose, either in whole or in part:
a) upon legitimate grounds, the handling of personal data regarding self, even if such data are relevant, with regard to the purposes underlying the collection thereof;
b) the handling of personal data regarding self for purposes connected with the sending of advertising material, with direct sales, market research or sales communications.

Art. 8 Exercise of rights
1. The rights described in article 7 are exercised, without the need for any formality, by a straightforward request to the data controller or the data processing supervisor, also through an authorised data processor, to which an appropriate reply must be given without delay.
2. The rights described in article 7 may not be exercised by making a request to the data controller or the data processing supervisor, or by filing an application pursuant to article 145, if the personal data are handled:
a) on the basis of the provisions of decree-law no. 143 of 3rd May 1991, converted, by amendments, by law no. 197 of 5th July 1991, and subsequent amendments thereto, dealing with recycling;
b) on the basis of the provisions of decree-law no. 419 of 31st December 1991, converted, by amendments, by law no. 172 of 18th February 1992, and subsequent amendments thereto, dealing with support to victims of extortion;
c) by parliamentary committees of inquiry set up in accordance with article 82 of the Constitution;
d) by a public figure other than public economic bodies, on the basis of an express legal provision, exclusively for purposes related to monetary and currency policy, to the system of payments, the monitoring of brokers and credit and financial markets, as well as the protection of their stability;
e) pursuant to article 24, 1st paragraph, letter f), with regard solely to the period during which there is a risk that the defence investigations that are being carried out or the right that is being exercised before judicial authorities will be effectively and tangibly prejudiced;
f) by suppliers of electronic communication services accessible to the public in relation to incoming telephonic communications, provided that there is a risk that the defence investigations referred to in law no. 397 of 7th December 2000 that are being carried out may be effectively and tangibly prejudiced;
g) on grounds of justice, at judicial offices at any stage or instance or the Upper Counsel of the Bench or other self-governing bodies or the Ministry of Justice;
h) pursuant to article 53, without prejudice to the provisions of legal enactment no. 121 of the 1st April 1981.
3. The Data Protection Registrar takes measures in the manner envisaged in articles 157, 158 and 159, also in response to notification by the data subject, in cases covered by paragraph 2, letters a), b), d), e) and f), and, in cases covered by letters c), g) and h) of the said paragraph, takes measures in the manner envisaged in article 160.
4. The rights described in article 7 may be exercised, when data of an objective nature are not involved, unless such action would amount to the adjustment or addition of personal data of an evaluative type relating to judgments, opinions or other appraisals of a subjective nature, or an indication of forms of conduct to be followed or decisions being taken by the data controller.

Art. 9 Methods by which rights can be exercised
1. The request made to the data controller or the data processing supervisor can be transmitted by registered letter, telefax or e-mail. The Data Protection Registrar may establish another appropriate system in the light of new technological solutions. When the rights envisaged under article 7, paragraphs 1 and 2 are being exercised, the request may also be made verbally and in such circumstances, a summarised record must be made by the data processor or the data processing supervisor.
2. When exercising the rights described under article 7, the data subject may confer written power of attorney or proxy upon individuals, bodies, associations or organisations. The data subject may also seek the assistance of an entrusted person.
3. The rights described in article 7 referring to personal data relating to deceased persons may be exercised by a person who has his or her own interests in such data or acts in order to safeguard the data subject or acts for family-based reasons worthy of protection.
4. The identity of the data subject is ascertained using appropriate evaluation tools, including deeds or documents available or the exhibition or attachment of a copy of an identification document. The person who acts on behalf of the data subject must exhibit or attach the copy of the power of attorney or proxy, signed in the presence of a data processor or signed and submitted together with a non-certified photocopy of a document identifying the data subject. If the data subject is a corporate body, organisation or association, the request must be made by the individual authorised to do so under the respective articles of association or regulations.
5. The request referred to under article 7, paragraphs 1 and 2, is made freely, without restrictions, and may be renewed, unless just grounds exist, after a period of no less than ninety days.

Art. 10 Reply to data subject
1. In order to ensure that the rights described under article 7 can be exercised, the data controller must take suitable measures directed, in particular:
a) at facilitating the access to personal data by the data subject, also by using processor programmes purposely designed to select with precision data relating to individual parties concerned who have been or can be identified;
b) at simplifying procedures and reducing the time taken in replying to the applicant, also within the scope of offices or services set up to handle relations with the public.
2. The data are extracted by the data processing supervisor or the data processors and may also be passed on to the applicant verbally, or submitted for examination using electronic equipment, provided that in these circumstances, the data can be easily understood, bearing in mind also the quality and quantity of the information. If requested, the data can be transferred onto paper-based or computerised media, or transmitted via computer.
3. Unless the request relates to a particular handling operation or specific personal data or categories of personal data, the reply to the data subject shall include all the personal data relating to the data subject in any event handled by the data controller. If the request is addressed to a subject exercising a profession within the health sector or to a health organisation, the provisions of article 84, paragraph 1 must be complied with.
4. If it proves particularly difficult to extract the data, the reply to the request made by the data subject may also be given by exhibiting or delivering copies of deeds and documents containing the personal data requested.
5. The right to receive data in intelligible form does not cover personal data relating to third parties, unless the decomposition of the data handled or the lack of certain elements renders the personal data relating to the data subject incomprehensible.
6. The data may also be transferred in intelligible form through the use of comprehensible forms of text. If codes or symbols are transferred, the parameters applying in order to comprehend the relevant meaning must also be supplied.
7. When, following a request made under article 7, paragraphs 1 and 2, letters a), b) and c), the existence of data relating to the data subject is not confirmed, a contribution towards costs may be demanded, not to exceed the actual costs incurred for the research carried out in the case in question.
8. The contribution referred to in paragraph 7 cannot, in any event, exceed the amount calculated by the Data Protection Registrar under directions of a general nature, which may be established as a lump sum in the event that the data are handled with the use of electronic equipment and the reply is given verbally. Under the same directions, the Data Protection Registrar may provide that a contribution be demanded when the personal data appear on a special form of medium whose reproduction is expressly required, or when the complexity or extent of the requests demand the extensive use of equipment, by one or more data controllers, and the existence of data relating to the data subject is confirmed.
9. The contribution referred to in paragraphs 7 and 8 may also be paid through the post office or bank, or by cash or credit card, if this can be done when the reply is received and, in any event, no later than fifteen days from the date of the reply.

close