Go back to the main page of the Data Protection Guidance for the organisers
Data Protection Guidance - Question 10
What should you do when handling data processing-related requests from signatories?
Applies to Case Scenario 2, except as regards the use of the Commission’s file exchange service
As data subject, a citizen supprting a citizens’ initiative (signatory) is entitled to request from the representative of the group of organisers:
- access to
- rectification of
- erasure of, and
- restriction of processing of
the personal data processed as part of the statements of support.
As regards email addresses, signatories can also withdraw their consent to further processing of these personal data (request to ‘unsubscribe’).
What should you check after receiving such a request?
- Whether any personal data of the signatory are being processed, i.e. whether the applicant has submitted a statement of support for the initiative (and an email address to receive updates on the progress of the initiative, where applicable).
For this, the representative may request the signatory to provide any information allowing them to retrieve the data (for example: Member State where data have been collected, approximate date of collection, etc.) However, irrespective of whether the data subject provides (further) information in this regard or not, the representative must make a reasonable effort in answering the request within the time limits. - Whether the applicant is the data subject concerned, or a legal representative/person entitled to present the applicant's request.
For this purpose, the representative may request proof of identity or a unique identifier of the submitted statement.
How should you reply to the request?
The actual request must be handled after it is confirmed that the answer to both questions above is positive. Information can be provided to the data subject in writing, electronically or even verbally. It must be provided without delay and at the latest within one month.
As a rule, when requests from the relevant signatory are not manifestly unfounded or excessive (in particular repetitive requests), the information must be provided free of charge.
PLEASE NOTE:
Request regarding signatories’ data collected using the central online collection system under joint controllership with the Commission are handled by the Commission. The obligation of the representative is limited to forwarding to the Commission any received requests of this kind.
References:
- Chapter III Sections 2 and 3 of the GDPR
