Exercising the right of access, rectification, erasure and portability of personal data, limitation and opposition to processing and not being subject to automated individual decisions regarding personal data registered with the Generalitat. - GVA.ES
Details of Procedure
Exercising the right of access, rectification, erasure and portability of personal data, limitation and opposition to processing and not being subject to automated individual decisions regarding personal data registered with the Generalitat.
Department: Presidencia de la Generalitat
Deadline for application: OPEN
What is it and what is it for?
To assist individuals whose personal data is processed by the Generalitat Valenciana in exercising their rights under data protection regulations.
The data controller (hereinafter the controller), will ensure that data subjects can exercise their rights under Regulation (EU) 2016/679 of the European Parliament and of the Council dated 27 April 2016 on the protection of individuals with regard to personal data processing and on the free movement of said data (hereinafter the GDPR), as well as those rights relating to the mechanisms for requesting and obtaining the data free of charge, unless the requests are manifestly unfounded or excessive. It should also provide the means for requests to be submitted by electronic means, in particular where personal data are processed by electronic means, and it will provide information by electronic means where possible, unless the data subject requests otherwise. In order to exercise rights, the identity of the applicant must be proven. - Right of access: regulated in Art. 13 of LO 3/2018, and Art. 15 of the GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed and, if so, the right of access to the personal data, under the terms established in the aforementioned regulations. - Right of rectification: regulated in Art. 14 of LO 3/2018, and Art. 16 and 19, the data subject has the right to obtain without undue delay from the controller the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of an additional declaration. - Right to erasure, the "right to be forgotten" regulated in Art. 15 of LO 3/2018, and Art. 17 and 19 of the GDPR, the data subject has the right to obtain without undue delay from the controller the erasure of personal data related to them, and the controller is obliged to erase said personal data without undue delay when any of the aforementioned circumstances occur under the terms set forth in the aforementioned regulations. - Right to data portability: regulated in Art. 17 of LO 3/2018, and Art. 20 of the GDPR, a data subject has the right to receive personal data relating to them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and to transmit them to another controller without being prevented from doing so by the controller to whom they have been provided, under the terms set out in the aforementioned regulations. - Right of limitation, regulated in Art. 16 of LO 3/2018 and in Art. 18 GDPR, the data subject has the right to obtain from the controller a restriction on the processing of their data when any of the conditions set out in the aforementioned regulations are met. - Right of opposition: regulated in Art. 18 of LO 3/2018, and Art. 21 GDPR, the data subject has the right to object at any time, on grounds relating to their individual situation, to the processing of personal data relating to them, under the terms set out in the aforementioned regulations. - Right not to be subject to automated individual decisions: regulated in Art. 18 of LO 3/2018 and in Art. 22 of the GDPR, every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way, within the meaning of the aforementioned legislation. BASIC INFORMATION ON DATA PROTECTION We hereby inform you of the characteristics of the processing that will be carried out on the personal data that you provide through the request to exercise your rights. - Name of the processing activity: Attention to data protection rights. - Purposes or uses of the processing: Management of requests to exercise individual personal data protection rights. - Data controller: the head of the sub-secretariat within the responsible conselleria (regional ministry) before which the right is exercised or the head of the body responsible for the matter in accordance with the organic and functional regulations. - Legal basis lawfulness or legitimacy: Under Article 6.1.c) of the GDPR, the processing is necessary in order to comply with a legal obligation applicable to the data controller. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), which repeals Directive 95/46/EC, and Organic Law 3/2018 dated 5 December on Personal Data Protection and the guarantee of digital rights. - Retention period: Requests will be kept for as long as is necessary. The provisions of the archives and documentation regulations will apply. - Type or categories of personal data: a) Identification: Name and surnames; DNI/NIF/NIE/Passport), address (postal or electronic); telephone (fixed or mobile); signature; digital fingerprint; electronic signature; access or identification credential. b) Other data: those that may be provided in the application. Categories of interested or affected parties and origin of the data: a) Applicants; legal representative or volunteer. b) Origin: directly from the person concerned. - Transfer or communication of data (categories of recipient parties): national Ombudsman or Comunitat Valenciana Ombudsman - Security, technical and organisational measures: the security measures implemented correspond to those set out in Appendix II (Security measures) to Royal Decree 3/2010, dated 8 January, which regulates the National Security Scheme in the field of e-Government.
Who can request it?
a) The person concerned, with proof of identity. b) When the person concerned is incapacitated or is a minor and cannot exercise these rights in person, they may be exercised by their legal representative, in which case it will be necessary for the representative to provide proof of their status. c) These rights can also be exercised through a voluntary representative, expressly appointed for the exercise of the right. In this case, the following must be clearly accredited: the identity of the person represented, by means of a copy of their National Identity Document or equivalent document; and the representation conferred by the person represented. Proof of representation may be provided by any legally valid means that provides a reliable record, or by means of a statement made by the person concerned in person. These rights will be refused if the application is made by a person other than the person concerned and if it is not proven that the person applying is acting on behalf of the person concerned.
Regulations of the procedure
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC
- Organic Law 3/2018, dated 5 December, on Personal Data Protection and the Guarantee of Digital Rights
- Law 39/2015, dated 1 October, on Common Public Administration Administrative Procedures
Open all year round, the right can be exercised at any time.
The rights must be exercised by means of a request addressed to the data controller. The application form can be found in the "associated forms" section. The application must contain: a) Name and surname(s) of the person concerned; number of the national identity card, passport or other valid document identifying the person concerned and, where appropriate, the same for the person representing them, or equivalent electronic instruments. In accordance with Art. 28 of Law 39/2015, if consent is not given to obtain the identity details of the applicant or, where applicable, of the legal representative, the applicant must provide supporting documentation (photocopy of the ID, passport, deed of powers of attorney or representation, etc.). b) Statement specifying the request. c) Address for the purposes of notifications (postal and/or electronic), date and signature of the applicant. d) Documents supporting the request being made, if applicable.
The person concerned may contact the conselleria (regional ministry) responsible for processing their data using the request form that they may submit, in accordance with Art. 16.4 Law 39/2015: a) On the electronic register of the Administration or Body to which they are addressed, as well as in the other electronic registers of any of the subjects referred to in Art. 2.1 of Law 39/2015. b) At post offices, in the legally established manner. c) In the diplomatic representations or consular offices of Spain abroad. d) At the registers assistance offices. e) At any other location established by the current provisions. Below you will find a search engine for the Generalitat's registers: http://www.gva.es/es/inicio/atencion_ciudadano/buscadores/registros
People who wish to submit applications electronically must click the Process with Certificate icon. To access online, the applicant must have available any of the electronic signature systems accepted by the Generalitat's online portal, including the certificate issued by the Comunitat Valenciana Certification Authority, as well as the Valencian key-signature system (https://sede.gva.es/va/sede_certificados). Procedures carried out through the Generalitat's online portal, but which are not registered, can be recovered at a later time to complete the online submission by accessing the personal area on the Generalitat portal from the section "how's mine going"-> "applications being created" (https://www.tramita.gva.es/cdc/login.html?idioma=es). In the event of any online incident, please consult: email@example.com
It can be started in person or online. AUTHORISATION: The data controller is obliged to deal with the request from the person concerned without undue delay and at the latest within one month of receipt of the request, although, depending on the complexity and number of requests, the deadline may be extended by a further two months. Once this period has elapsed without an express response to the request, the person concerned may lodge the complaint provided for in Article 37 of Organic Law 3/2018, dated 5 December on Personal Data Protection and the Guarantee of Digital Rights. In the case of the right to access, it will be understood to be granted if the data controller provides the data subject with a system of remote, direct and secure access to their person concerned, which guarantees permanent access to all their personal data. In the event that it does not have the personal data of the persons concerned, it must also inform them within the same period. DENIAL: The data controller may refuse the request if the right has already been exercised in the SIX months prior to the request and no legitimate interest is demonstrated. Access may also be refused in cases where a law or a directly applicable rule of Community law so provides or where it prevents the data controller from disclosing to data subjects the processing of the data to which access relates. Erasure will not take place when the personal data must be kept for the periods provided for in the applicable provisions or, where applicable, in the contractual relations between the data controller and the person concerned that justified the processing of the data. In any case, the data controller will inform the person concerned of their right to seek the protection of the Spanish Data Protection Agency, as well as to contact the Generalitat Valenciana's Data Protection Delegate.
The processing bodies will be, as a general rule, the different sub-secretariats of the ministries where the request is directed, or if not, the provisions of the organic and functional regulations of the ministries responsible for data processing will be followed. CONSELLERIA FOR PARTICIPATION, TRANSPARENCY, COOPERATION AND DEMOCRATIC QUALITY
Once this period has elapsed without an express response to the request, the person concerned may lodge the complaint provided for in Article 37 of Organic Law 3/2018, dated 5 December on Personal Data Protection and the Guarantee of Digital Rights.
One month of receipt of the request, although, depending on the complexity and number of requests, the deadline may be extended by a further two months.
CONSELLERIA FOR PARTICIPATION, TRANSPARENCY, COOPERATION AND DEMOCRATIC QUALITY
Exhausts administrative life