Rights of Data Subjects and Their Implementation
The EU General Data Protection Regulation guarantees various rights to the data subject. The rights apply differently depending on the intent of collection of personal data. The individual has, among others, the right to know whether and what personal data are being processed about said individual, and the right to access the information collected as well as the right to rectification if the data is incorrect or incomplete.
EU General Data Protection Regulation (EU) 2016/679
Data Subject Access Request (Article 15)
A person has the right to know whether or not their personal data is being processed, and what personal data is stored. If you want to check with the Town of Hamina what personal data has been stored about you or what personal data is being processed, do the following:
Submit an individualized, written request for information in person to the Hamina Town Registry Office. Your identity will be verified, so please bring a photo ID (driver's license, passport, ID card, etc.)
The Town of Hamina will respond to the data subject's request for information as soon as possible. The deadline for submitting the information or providing additional information related to the request for information is one month from the receipt of said request. If the request for information is exceptionally complex and extensive, the deadline may be extended by two months.
Access to the data subject's stored data is provided, in general, free of charge. However, if multiple copies are requested, the town may charge a reasonable fee based on administrative costs (Right of access documents and mailing fees of said documents as of January 1.1.2018, XNUMX). If a request for information is clearly unfounded and unreasonable, especially if requests for information are made repeatedly, the town may charge the administrative costs incurred in providing the information or refuse to provide the information altogether. In such a case, the town shall demonstrate the basis for the denial of the request.
If the town does not provide information, a written decision will be issued. At the same time, we will inform you about the right to legal remedies, for example, the possibility of filing a complaint with a supervisory authority.
Right to Rectification (Article 16)
The person has the right to demand that incorrect, inaccurate or incomplete personal data concerning him or her be corrected or completed without undue delay. The person also has the right to demand that unnecessary personal data be deleted. The unnecessaryness and inaccuracy are assessed according to the time the data was stored.
If the town does not accept the request for rectification, a written decision will be issued stating the reasons for not accepting the request. We will also inform you about the right to legal remedies, for example, the possibility of filing a complaint with a supervisory authority.
The Right to be Forgotten (Article 17)
Only in certain exceptional cases does a person have the right to have their personal data completely deleted from the city's registers (the right to be forgotten). However, such a right does not exist in cases where the processing of personal data is necessary for compliance with a legal obligation or for the exercise of public authority vested in the city. The city's archiving plans and the data retention periods required by law are followed in the retention and deletion of data.
Right to Restrict Processing (Article 18)
In certain situations, an individual may have the right to request that the processing of their personal data be restricted until their data has been appropriately reviewed and corrected or supplemented.
Right to Data Portability (Article 20)
The right does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Therefore, as a general rule, the right does not apply to the personal registers of the Town of Hamina.
Right to Object to Processing (Article 21)
The person has the right, on grounds relating to the individual's particular situation, to object at any time to the processing of his or her personal data. This includes where the processing is carried out for the performance of a task executed for the purposes of public interest or exercise of the official authority vested in the town. In such a case, the data may only be further processed if there are compelling legitimate grounds that can be demonstrated.
Right to File a Complaint with an Authority (Article 77)
The individual has the right to lodge a complaint, in particular with the supervisory authority for the location of his or her permanent residence or place of work, if he or she considers that the processing of personal data infringes the EU General Data Protection Regulation (EU) 2016/679. In addition, the individual has the right to use other administrative remedies and legal remedies.
A person also has the right to file a lawsuit against a data controller or a personal data processor organization if they believe their rights have been violated because the processing of their personal data has not complied with the General Data Protection Regulation.
How are rights implemented?
The correction and information request forms can be found in the attached appendices.