Know your rights
Law No. 1.565 of December 3, 2024 grants a number of rights to the data subjects. These, totaling 8, are as follows:
Right to be informed: a person must be informed in a clear and understandable manner about the use of their personal data, namely what data are collected, by whom, and for what purpose.
Example: a sign posted at the entrance of a store featuring at least a pictogram of a camera and the procedures for exercising the rights of the data subjects informs them of the installation of a video surveillance system on the premises
[For more information, refer to Information to be provided to the data subjects]
Right of access: a person may request confirmation from the data controller as to whether or not their data are being processed, and if so, to have them communicated to them in a readable and comprehensible form.
Example: an employee can request the contents of his or her HR file
Right to rectification: a person may request, with supporting documents, that inaccurate or incomplete data be corrected or completed.
Example: following his or her marriage, an employee can request the Human Resources Department to change his or her legal name.
Right to erasure: a person may request, in very specific cases defined by the Law, that his or her data be erased, whether or not they are public.
Example: a person who has subscribed to a newsletter has the right to request that his or her e-mail address be deleted from the mailing list if he or she no longer wishes to receive the newsletter.
Right to restriction of processing: a person can request of the data controller that certain personal data must temporarily no longer be processed except for storage purposes.
Example: a person who disputes the accuracy of his or her data may ask the data controller to ‘freeze’ their processing for the time necessary to verify the data
Right to object: a person may object to his/her data being used by a data controller for a specific purpose, for example when the processing is based on a ground of public interest or the legitimate interest of the data controller. To do so, they must provide « reasons related to their particular situation », except in the case of commercial prospecting, to which they may object without providing a reason.
Example: an Internet user can refuse the installation of tracking "cookies" on a site that he or she visits.
Right to data portability: a person can, under certain conditions provided by the Law, obtain from a data controller the personal data they have provided in a structured, commonly used, and machine-readable format. In this way, they will be able to easily reuse these data and, if they wish, have the said data transmitted to another data controller.
Example: a person can request from the music streaming platform which they subscribe for a list of the songs they have listened to since the beginning of the year.
Right to not be subject to an automated individual decision: a person may not be subject to a decision that is based solely on automated processing, without any human intervention, when the decision produces legal effects with regard to the data subject or significantly affects him or her.
Example: the refusal of a bank loan solely based on an algorithm.
[For more information, refer to The rights of the data subjects with regard to their personal data]