Obligation to delete personal data
You have the right to ask us to delete the personal data concerning you with undue delay where one of the following grounds applies:
- the personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
- you withdraw the consent on which the processing is based according to point a) of Article 6 (1) or point a) of Article 9 (2) of the GDPR and there is no other legal ground for processing;
- you object to the processing pursuant to Article 21 (1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing to Article 21 (2) of the GDPR;
- the personal data concerning you has been unlawfully processed;
- the deletion of personal data concerning you is necessary for compliance with a legal obligation in EU or Member State law that we are subject to;
- the personal data concerning you has been collected in relation to the offer of information society services referred to in Article 8 (1) of the GDPR.
Information to third parties
If we have made the personal data concerning you public and if we are obliged, pursuant to Article 17 (1) of the GDPR, to delete the personal data concerning you, we will, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform the controllers processing the personal data that you as data subject have requested the deletion of any links to or copies or replication of such personal data.
Exceptions
The right to deletion shall not apply to the extent that processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation that requires processing by EU or Member State law that we are subject to, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
- for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9 (2) of the GDPR as well as Article 9 (3) of the GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) of the GDPR in so far as the right referred to in paragraph 1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
- for the establishment, exercise or defence of legal claims.
Right of information
If you have exercised your right of rectification, deletion or restriction of processing against us, we are obliged to inform all recipients to whom the personal data concerning you has been disclosed, of this rectification or deletion of the data or restriction of processing unless this proves impossible or involves a disproportionate effort.
You have the right vis-à-vis us to be informed of these recipients.
Right to data portability
You have the right to receive the personal data concerning you, which you have provided us with, in a structured, commonly used and machine-readable format. You furthermore have the right to transmit that data to another controller without hindrance from us, where:
- the processing is based on consent pursuant to point (a) of Article 6 (1) of the GDPR or point (a) of Article 9 (2) of the GDPR or on a contract pursuant to point (b) of Article 6 (1) of the GDPR; and
- the processing is carried out by automated means.
In exercising this right, you also have the right to request that the personal data concerning you be transferred directly by us to another controller, where technically feasible. The freedoms and rights of other persons must not be affected hereby. The right to data portability shall not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6 (1) of the GDPR, including profiling based on those provisions. As a result, we no longer process the personal data concerning you unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise of defence of legal claims. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
Right to revoke the data protection declaration of consent
You have the right to revoke your data protection declaration of consent at any time. The revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until revocation.
Automated individual decision-making including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which affects you similarly significantly.
This shall not apply if the decision:
- is necessary for entering into or performing a contract between you and us; ,
- is authorised by EU or Member State law that we are subject to and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
- is based on your explicit consent.
These decisions, however, shall not be based on special categories of personal data referred to in Article 9 (1) of the GDPR unless point (a) or (g) of Article 9 (2) applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place. In cases referred to in paragraphs 1. and 3. we implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of us, to express your point of view and to contest the decision.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.
The competent supervisory authority of DZNE is:
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Straße 153
53117 Bonn
+49 228 997799-0