1. A data subject has the right, freely and at reasonable intervals, to request the responsible party
to inform him as to whether personal data relating to him are being processed. The responsible
party shall inform the data subject in writing within four weeks as to whether personal data
relating to him are being processed.
2. In the event that such data are being processed, the information provided shall contain a full
and clear summary thereof, a definition of the purpose or purposes of the processing, the data
categories to which the processing relates and the recipients or categories of recipients, as well as
the available information about the origin of the data.
3. Prior to the providing of information referred to under (1) to which a third party may be
expected to object, the responsible party shall give the third party an opportunity to express its
views where such information contains data concerning that third party unless this appears to be
impossible or would involve a disproportionate effort.
4. Upon request, the responsible party shall provide information concerning the underlying logic
of the automated processing of data relating to the data subject.
Article 36
1. A person who has been informed about personal data relating to him in accordance with
Article 35 may request the responsible party to correct, supplement, delete or block the said data
in the event that it is factually inaccurate, incomplete or irrelevant to the purpose or purposes of
the processing, or is being processed in any other way which infringes a legal provision. The
request shall contain the modifications to be made.
2. The responsible party shall inform the requester in writing within four weeks of receiving the
request as to whether and, if so, to what extent, it is complying therewith. A refusal to do so
must be accompanied by the reasons.
3. The responsible party must make sure that a decision to correct, supplement, delete or block
data is implemented as quickly as possible.
4. Where personal data have been recorded on a data carrier to which no modifications can be
made, the responsible party must take the necessary steps to inform the data user that it is
impossible to correct, supplement, delete or block the data, even where there are grounds under
this article for modifying the data.
5. The provisions of (1) to (4) do not apply to public registers set up by law where this law
provides for a special procedure for correcting, supplementing, deleting or blocking data.
Article 37
1. Where an important interest of the requester so requires, the responsible party shall reply to
the request referred to in Articles 35 and 36 in a form, other than in writing, which takes due
account of this interest.
2. The responsible party shall make sure that the identity of the requester is properly established.
3. In the case of minors who have not yet reached the age of sixteen, and of persons placed under
legal restraint, the requests referred to in Articles 35 and 36 shall be made by their legal
representatives. The information concerned shall also be provided to the legal representatives.
Article 38