Search results

Outdated personal data is a subset of inaccurate personal data, as the data became inaccurate over time. The consequences for data subjects can be very

of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects

personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of

provided by the data subject (e.g. account data submitted via forms, answers to a questionnaire); observed data or raw data provided by the data subject by

as such, covered by the GDPR. Personal data is often contrasted with 'anonymous' data. Anonymous data is data relating to a person that is not identifiable

require the controller to comunicate a personal data breach to a data subject, if it considers that the data breach is resulting in a high risk. The order

where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are

provided where personal data are collected from the data subject 1. Where personal data relating to a data subject are collected from the data subject, the controller

office is in Madrid. The requirement to have a data protection authority stems from Article 44 of the Spanish Data Protection Act, which is the national act

applies to personal data which concerns the data subject. This primarily includes the data subject's own personal data, including profiling data, and not those

processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural

Articles 5, 6, 7 and 9; (b) the data subjects' rights pursuant to Articles 12 to 22; (c) the transfers of personal data to a recipient in a third country

provided where personal data have not been obtained from the data subject 1. Where personal data have not been obtained from the data subject, the controller

requests by data subjects in accordance with Chapter III of the GDPR. For example: A data broker collects personal data from a vast amount of data. It has

that the data is first processed. However, if data is collected directly from the data subject, Article 13(2)(b) GDPR requires that the data subject will

where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are

corrective measures requested, as well as the identification of the data controller or data processor, where known. If possible, the complaint shall contain

shall be able to demonstrate that the data subject has consented to processing of his or her personal data. 2. If the data subject's consent is given in the

inform the affected data subjects. The EDPB emphasizes that a data breach is ultimately a matter of data security directly affecting the data subjects' interests

security measures, compliance with data retention requirements, data location, data transfers, data access, recipients of data, use of sub-processors, and other