Privacy
The right of access
The right of access: to know what data an organization holds on you
You can ask an organization if it has data on you (website, store, bank…) and ask to be given it to verify its content.
What's the point?
The exercise of the right of access allows you to find out whether your personal data is being processed and to obtain communication of it in an understandable format. It also allows you to check the accuracy of the data and, if necessary, to have them corrected or deleted.
The organization from which you request your “right of access” will have to send you a copy of the data it holds on you and provide you with a certain amount of information:
- the purposes for which your data will be used (what your data will be used for) ;
the categories of data collected (e.g.: name, first name, address, etc.); - the organizations or persons who may have access to your data;
- how long your data will be kept or the criteria that determine this period;
- your other rights (right of rectification, deletion, limitation, opposition);
- the possibility of sending a complaint to the regulatory authority;
- any information relating to the source of the data collected (i.e. where your data comes from) if it has not been directly collected from you;
- the existence of automated decision-making (including profiling), how it works, the importance and consequences for you of such a decision. The information provided must be sufficiently complete for you to understand the reasons for the decision;
- whether your data will be transferred to a country outside the European Union or to an international organization.
How to do it concretely?
1. Identify the organization to contact
You can find the coordinates of Atlante Technologies on the information page reserved for the exercise of your rights on the website.
www.atlante.technology
- Privacy Center
- Legal Center
- Data Protection
Data protection officer
dpo@atante.technology
Canada
Atlante Technologies Inc.
336 de L’Artisan Street
Bromont, Quebec
J2L 0J7
United Kingdom – Satellite Office
Atlante Technologies Ltd.
20-22 Wenlock Road
London, England
N1 7GU
2. Exercise your right of access to the organization
You can exercise your right of access by various means: electronically (form, e-mail address, download button, etc.), or by mail for example.
If your request is made electronically, the organization will respond electronically, unless you request otherwise (e.g. by mail).
If the organization has reasonable doubts about your identity, it may ask you to attach any document that proves your identity, for example to prevent identity theft. However, they cannot ask you for supporting documents that would be disproportionate to your request.
There is no charge for exercising this right. You may be asked to pay a reasonable fee for processing your file, for example, if you request an additional copy.
3. Keep a copy of your application
This step is essential if you wish to refer the matter to the regulatory authority in the event of a refusal, unsatisfactory response or lack of response.
Are you doing this by mail? Ask for an acknowledgement of receipt that will prove the date of your request.
What should I do if I get a refusal or no response?
The organization must respond to you as soon as possible and no later than one month. This period may be extended to three months depending on the complexity of the request or the number of requests received by the organization. In the latter case, the organization must inform you of the reasons for the extension within the same one-month period.
If the organization does not respond within one month or refuses to grant your request, you may file a complaint with the regular authorities with evidence of your prior actions. During this period, you can request the limitation of the processing, i.e. the “freezing” of the use of your data.
What should I do if my answer is incomplete?
If you feel that the organization’s response to your request for access is incomplete, you can complain to the regulatory authority so that it can intervene in support of your request.
However, it is recommended that you first ask the regulatory authority to complete its response with the data you consider to be missing. If there is no response or if the response is unsatisfactory, you can file a complaint with the regulatory authority, enclosing proof of your previous actions.
What are the limits of the right of access?
Some files are particularly regulated. For certain police files or files concerning State security, the law does not authorize a private individual to directly access the information contained in the file. However, he or she can access it indirectly through the regulatory authority.
If the agency believes that your request is unfounded or excessive, it may refuse to grant access, provided that it can demonstrate that the request is “unfounded” or “excessive.
The right of access must not affect the rights of third parties:
- Only your data can be communicated under the right of access. For example, it is not possible to request access to your spouse’s data or obtain a copy of unblurred images of other people;
- The right of access may not infringe on business secrets or intellectual property (copyright protecting software, for example).
In practice, the organization may hide the identity of third parties or elements that indirectly identify them in its response.
Privacy Center
Data Protection Officer
Source : CNIL
Commission Nationale de l’Informatique et des Libertés
To protect personal data, support innovation, preserve individual liberties