Article 10*

Article 10 – Modalities for exercising the rights of the data subject

Commission Proposal

1. Member States shall provide that the controller takes all reasonable steps to have transparent and easily accessible policies with regard to the processing of personal data and for the exercise of the data subjects’ rights.2. Member States shall provide that any information and any communication relating to the processing of personal data are to be provided by the controller to the data subject in an intelligible form, using clear and plain language.3. Member States shall provide that the controller takes all reasonable steps to establish procedures for providing the information referred to in Article 11 and for the exercise of the rights of data subjects referred to in Articles 12 to 17.

4. Member States shall provide that the controller informs the data subject about the follow-up given to their request without undue delay.

5. Member States shall provide that the information and any action taken by the controller following a request referred to in paragraphs 3 and 4 are free of charge. Where requests are vexatious, in particular because of their repetitive character, or the size or volume of the request, the controller may charge a fee for providing the information or taking the action requested, or the controller may not take the action requested. In that case, the controller shall bear the burden of proving the vexatious character of the request.

EDRi’s proposed amendment

1. Member States shall provide that the controller takes all reasonable steps to shall have transparent and easily accessible policies with regard to the processing of personal data and for the exercise of the data subjects’ rights.2. Member States shall provide that any information and any communication relating to the processing of personal data are to be provided by the controller to the data subject in an intelligible form, using clear and plain language.3. Member States shall provide that the controller takes all reasonable steps to establish procedures for providing the information referred to in Article 11 and for the exercise of the rights of data subjects referred to in Articles 12 to 17.

4. Member States shall provide that the controller informs the data subject in writing about the follow-up given to whether or not any action has been taken following their request without undue delay, at the latest within one month.

5. Member States shall provide that the information and any action taken by the controller following a request referred to in paragraphs 3 and 4 are free of charge. Where requests are vexatious manifestly excessive, in particular because of their repetitive character, or the size or volume of the request, the controller may charge a fee for providing the information or taking the action requested, or the controller may not take the action requested. In that case, the controller shall bear the burden of proving the vexatious manifestly excessive character of the request.

Justification

This proposed amendments aligns this Article with Articles 11 and 12 of the proposed Regulation. Controllers should always have transparent and easily accessible policies in place, should reply to requests within a specified amount of time and in written form and only charge for manifestly excessive requests. Controllers should also be obliged to inform data subjects of possible ways of challenging a negative reply to an access request. The criterion of “size or volume of the request”, which is not included in the corresponding provisions of the Regulation and should be omitted here as well.

While it is true that certain limitations to data subject rights might be justified in the law-enforcement context, Articles 11 to 13 already provide for at least sufficient possibilities for restrictions.

  • eu logo The launch and upkeep (until December 31, 2012) of this website received financial support from the EU's Fundamental Rights and Citizenship Programme.
Follow

Get every new post delivered to your Inbox.

%d bloggers like this: