What Needs to be Done Prior to Collection

Contact the data subject

Contact the Data Protection Authority

Article 11 Right to information

1. The Controller must, during the stage of collection of personal data, inform the data subject in an appropriate and express manner of the following data:

a) his/her identity and the identity of his/her representative, if any,

b) the purpose of data processing,

c) the recipients or the categories of recipients of such data,

d) the existence of a right to access.

2. If the Controller, in order to collect personal data, requests the data subject's assistance, s/he must inform him specifically and in writing of the data referred to in paragraph 1 of this article as well as of his/her rights according to articles 11-13 of this law. By means of such notification the Controller shall also inform the data subject whether s/he is obliged to assist in the collection of data, on the basis of which provisions, as well as of any sanctions resulting from his/her failure to co-operate.

3. If the data are to be disclosed to third parties, the data subject will be kept informed of such disclosure before it is affected.

4. By virtue of a decision by the Authority, the obligation to inform, pursuant to paragraphs 1 and 3, may be lifted in whole or in part, provided that data processing is carried out for reasons of national security or for the detection of particularly serious crimes. In a state of emergency said obligation may be lifted by way of a provisional, immediately enforceable judgement by the President, who shall convene as soon as possible the Board in order that a final judgement on the matter may be issued.

5. Without prejudice to the rights arising from paragraphs 12 and 13, the right to inform does not exist when such collection is carried out solely for journalistic purposes and refers to public figures.

Contact the Data Protection Authority

Article 6 - Notification

1. The Controller must notify the Authority in writing about the establishment and operation of a file or the commencement of data processing.

2. In the course of the aforementioned notification the Controller must necessarily declare the following:

a) his/her name, trade name or distinctive title, as well as his/her address. ]

b) the address where the file or the main hardware supporting the data processing are established.

c) the description of the purpose of the processing of personal data included or about to be included in the file

d) the categories of personal data that are being processed or about to be processed or included or about to be included in the file.

e) the time period during which s/he intends to carry out data processing or preserve the file.

f) the recipients or the categories of recipients to whom such personal data are or may be communicated.

g) any transfer and the purpose of such transfer of personal data to third countries.

h) the basic characteristics of the system and the safety measures taken for the protection of the file or data processing.

1. The data referred to in the preceding paragraph will be registered with the Files and Data Processing Register kept by the Authority.

2. Any modification of the data referred to in paragraph 2 must be communicated in writing and without any undue delay by the Controller to the Authority.