The fundamental right to data protection (derived from our Constitution) gives citizens a power of disposal over their data, so that they can dispose of it. The European Data Protection Regulation specifically recognises the following data protection rights for citizens:

These rights have the following particularities:

• Their exercise is free of charge.
• If the requests are manifestly unfounded or excessive (e.g. repetitive nature) the controller may:
  • Charge a fee proportional to the administrative costs incurred.
  • Refuse to act.
• Requests must be responded to within one month, although, taking into account the complexity and number of requests, the deadline may be extended for a further two months.
• If the request is made by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests otherwise.
• If the data controller does not comply with the request, it shall inform the data subject within one month at the latest of the reasons for its failure to act and of the possibility of lodging a complaint with a supervisory authority.
• The rights may be exercised directly or through a legal representative or volunteer.