Online Job Tips

 The principles of fair and transparent processing require that the data subject be informed of the existence of the 

processing operation and its purposes. The controller should provide the data subject with any further 

information necessary to ensure fair and transparent processing taking into account the specific circumstances 

and context in which the personal data are processed. Furthermore, the data subject should be informed of the 

existence of profiling and the consequences of such profiling. Where the personal data are collected from the 

data subject, the data subject should also be informed whether he or she is obliged to provide the personal data 

and of the consequences, where he or she does not provide such data. That information may be provided in 

combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a 

meaningful overview of the intended processing. Where the icons are presented electronically, they should be 

machine-readable. 

(61) The information in relation to the processing of personal data relating to the data subject should be given to him 

or her at the time of collection from the data subject, or, where the personal data are obtained from another 

source, within a reasonable period, depending on the circumstances of the case. Where personal data can be 

legitimately disclosed to another recipient, the data subject should be informed when the personal data are first 

disclosed to the recipient. Where the controller intends to process the personal data for a purpose other than that 

for which they were collected, the controller should provide the data subject prior to that further processing with 

information on that other purpose and other necessary information. Where the origin of the personal data 

cannot be provided to the data subject because various sources have been used, general information should be 

provided. 

(62) However, it is not necessary to impose the obligation to provide information where the data subject already 

possesses the information, where the recording or disclosure of the personal data is expressly laid down by law 

or where the provision of information to the data subject proves to be impossible or would involve a dispropor-

tionate effort. The latter could in particular be the case where processing is carried out for archiving purposes in 

the public interest, scientific or historical research purposes or statistical purposes. In that regard, the number of 

data subjects, the age of the data and any appropriate safeguards adopted should be taken into consideration. 

(63) A data subject should have the right of access to personal data which have been collected concerning him or her, 

and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of 

the processing. This includes the right for data subjects to have access to data concerning their health, for 

example the data in their medical records containing information such as diagnoses, examination results, 

assessments by treating physicians and any treatment or interventions provided. Every data subject should 

therefore have the right to know and obtain communication in particular with regard to the purposes for which 

the personal data are processed, where possible the period for which the personal data are processed, the 

recipients of the personal data, the logic involved in any automatic personal data processing and, at least when 

based on profiling, the consequences of such processing. Where possible, the controller should be able to provide 

remote access to a secure system which would provide the data subject with direct access to his or her personal 

data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual 

property and in particular the copyright protecting the software. However, the result of those considerations 

should not be a refusal to provide all information to the data subject. Where the controller processes a large 

quantity of information concerning the data subject, the controller should be able to request that, before the 

information is delivered, the data subject specify the information or processing activities to which the request 

relates. 

(64) The controller should use all reasonable measures to verify the identity of a data subject who requests access, in 

particular in the context of online services and online identifiers. A controller should not retain personal data for 

the sole purpose of being able to react to potential requests. 

(65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be 

forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the 

controller is subject. In particular, a data subject should have the right to have his or her personal data erased 

and no longer processed where the personal data are no longer necessary in relation to the purposes for which 

they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to 

the processing of personal data concerning him or her, or where the processing of his or her personal data does 

not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given