Article 10 — Right of Access

1. 1.

   The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. Where such processing is taking place, the data subject shall have the right to access the personal data and the following information:

   1. The purposes of the processing.
   2. The categories of personal data concerned.
   3. The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in foreign jurisdictions or international organisations.
   4. Where possible, the envisaged period for which the personal data will be stored, or if not possible, the criteria used to determine that period.
   5. The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject, or to object to such processing.
   6. The right to lodge a complaint with the competent supervisory authority of the State.
   7. Where the personal data are not collected from the data subject, any available information as to their source.
   8. The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. 2.

   Where personal data are transferred to a foreign jurisdiction or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards applied in relation to the transfer.

3. 3.

   The controller shall provide a copy of the personal data undergoing processing. The first copy shall be provided free of charge. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic format.

4. 4.

   The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, that consideration shall not result in a refusal to provide all information to the data subject.

5. 5.

   The controller shall respond to a request under this Article without undue delay and in any event within thirty days of receipt of the request. That period may be extended by a further thirty days where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within the initial thirty-day period, together with the reasons for the delay.

6. 6.

   Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.