In accordance with Articles 15 to 22, the Regulation enables Data Subjects to exercise specific rights.
In particular, a Data Subject may obtain: a) confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data; b) the rectification of inaccurate personal data concerning him or her and to have incomplete personal data completed; c) the erasure of personal data concerning him or her, where permitted by the Regulation; d) the restriction of processing, in the cases provided for by the Regulation; e) the communication of any request for rectification/erasure of personal data or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort; f) his or her personal data, which he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format and to have the right to transmit those data to another Data Controller, at any time, even on termination of any relationship established with the Data Controller.
The Data Subject also has the right to oppose, at any time, the processing of personal data concerning him or her: in this case, the Data Controller is obliged to refrain from any further processing, save for the purposes allowed by the Regulation.
The Data Subject also has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, except for where this decision is: a) necessary to enter into or perform a contract between the Data Subject and the Data Controller; b) authorised by Union law or by the laws of the Member state under which jurisdiction the Data Controller falls; c) based on the Data Subject’s explicit consent. In the cases specified in points a) and c) above, the Data Subject has the right to obtain human intervention from the Data Controller, to express his or her opinion and to contest the decision.
These requests may be submitted to the organisational unit responsible for replying to the Data Subject, by letter, to be sent to the Data Controller’s headquarters, or by e-mail, to firstname.lastname@example.org.
The Data Subject also has the right to lodge a complaint with Garante Privacy [Italian Data Protection Authority], as set out by Article 77 of the Regulation, and to an effective judicial remedy in accordance with Articles 78 and 79 of the Regulation.