Exercising data protection rights

The following rights may be requested by the owner of the data, as recognised through the current legislation:

RIGHT OF ACCESS: This is the power or capacity that recognises the interested party’s right to obtain information on whether their personal data is being handled, the purpose of the handling, the origin of the handling and the assignments or communications made or that are expected to be made and, where appropriate, the term during which their data is to be stored. The interested party has the right to check that the Law is complied with and to detect possible breaches by the entities that process their data.

RIGHT TO RECTIFICATION: This is the power or capacity of the interested party through which they can call upon the data controller to comply with its obligation to maintain the accuracy of the data, rectifying personal data in the case that it is incomplete or inaccurate, in order for the handling to involve a true reflection of reality.

RIGHT TO ERASURE: This is the power or capacity of the interested party through which they can call upon the data controller to exclude all or part of their personal data from the handling when it is no longer necessary in relation to the purposes for which it was obtained or was subjected to handling, or in the event that it is excessive, or if its handling does not comply with the Law. However, personal data must be kept for the terms stipulated in the applicable provisions or, as the case may be, during the contractual relationships held between the person or entity responsible for the handling and the interested party. In short, the Law establishes the possibility for the data controller to oppose the request for deletion when there are causes for this, either under the legal protection of the handling or due to the existence of a contractual relationship between the interested party and the person responsible for the file that must be terminated before the data is deleted (cases in which the handling is essential for the execution of the contract).

RIGHT TO OBJECT: This consists of the right of the data subject not to have his or her personal data processed or to have the processing of such data stopped when:

1. Your consent to the processing is not required because there is a legitimate and well-founded ground relating to your specific personal situation which justifies it, unless otherwise provided for by law.
2. Processing operations for the purposes of marketing, advertising and commercial prospecting activities, including profiling, regardless of the company responsible for their creation.
3. The purpose is to take a decision relating to the data subject and based solely on automated processing of his or her personal data.

RIGHT TO PORTABILITY: This is the power or capacity of the interested party through which they can call upon the data controller to provide them with the personal data that they have provided in a structured format, of common use and which can be mechanically read, and to send it to another data controller. This right, which is applied under certain conditions, supports the choice, control and capacities of the user.

RIGHT TO RESTRICTION OF PROCESSING:

1. The interested party challenges the accuracy of the personal data, during a period that allows the person responsible to verify the accuracy thereof.
2. The handling performed is illegal and the interested party opposes the deletion of their personal data, requesting instead a limitation of the use thereof.
3. The person responsible does not require the handling of the personal data for the purposes for which they were requested, but the interested party requests that the data is kept in order to make and exercise or defend claims.
4. The interested party has exercised their right of deletion, and the data is kept during the term for verification purposes.

Responsible unit:
Central Data Protection Office (OCPD)

Postal address:
C/ Peonías, 12
28042 Madrid

E-mail:
ocpd@aena.es