Individuals whose data is processed are entitled to know what happens with their personal information (principle of loyalty). In doubt, they must be able to act themselves.
The amended Act of 2 August 2002 gives the citizens specific rights, determines how they can be exercised and defines its limits.
The controller must ensure that the subjects on who he/she collects, records and uses information:
- are informed about the processing concerning them (before the data is being processed);
- have access to the data about them that is being processed (on their request);
- are able to object to the data about them being processed.
Besides these provisions, the Data Protection Act also determines the conditions under which automated individual decisions can be carried out.