Transparent information, communication and modalities for exercising data subject rights
The controller shall take appropriate measures so that the data subject receives the information referred to in Articles 13 and 14 and the communications referred to in Articles 15 to 22 and Article 34 in relation to the processing in a concise, transparent, intelligible and easily accessible form, and in clear and plain language, in particular where the information is addressed specifically to a child. The information shall be provided in writing or by other means, including, where appropriate, electronic means. If requested by the data subject, the information may be communicated orally, provided that the identity of the data subject is proved by other means.
The controller shall facilitate the exercise of the data subject's rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to comply with the data subject's request to exercise the data subject's rights under Articles 15 to 22, unless the controller demonstrates that it is unable to identify the data subject.
The controller shall provide the data subject with information on the follow-up given to the request without delay and in any event within one month of receipt of the request pursuant to Articles 15 to 22. Depending on the complexity of the requests and on the number of requests, that period may be extended, if necessary, by a further two months. The controller shall notify the data subject of such an extension within one month of receiving the request. Where the data subject makes the request electronically, the information shall be provided electronically whenever possible, unless the data subject requests otherwise.
Where the controller does not act on the data subject's request, it shall inform the data subject without delay and, at the latest within one month of receipt of the request, of the reasons why the request was not acted on, and shall inform the data subject of the possibility to lodge a complaint with a supervisory authority and to seek judicial remedy.
The provision of the information referred to in Articles 13 and 14, and the communication and taking of the measures referred to in Articles 15 to 22 and Article 34 shall be free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive nature, the controller may either:
A charge a reasonable fee in light of the administrative costs involved in providing the requested information or communication and taking the requested action; or
B refuse to comply with the request.It is for the controller to demonstrate the manifestly unfounded or excessive nature of the request.
Without prejudice to Article 11, where the controller has reasons to doubt the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request additional information necessary to confirm the identity of the data subject.
The information to be provided to data subjects under Articles 13 and 14 may be provided using standardized icons to provide the data subject with a useful overview, in a readily visible, understandable and clearly legible form, of the intended processing. Where the icons are displayed electronically, they shall be machine-readable.
The Commission shall be empowered to adopt delegated acts in accordance with Article 92 to determine what information the icons should display and the procedures by which the standardized icons should be created.
