The GRDP requires controllers to facilitate the exercise of the data subjects’ rights. This requirement establishes that procedures and methods to do so must be visible, accessible and simple. This obligation requires to set up procedures enabling data subjects to easily prove that they have exercised their rights by electronic means, which is not always viable at present.
The exercise of rights shall be free of charge for the data subject, unless:
Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee taking into account the administrative costs of taking the action requested; or refuse to act on the request (such fee cannot represent additional income for the controller but should effectively correspond to the true cost of the processing of the request).
The controller shall provide information on the actions taken on a request to the data subject within one month (that period may be extended by two further months if requests are especially complex and the controller shall inform the data subject of any such extension within one month). If the controller decides not to take action on the request, the controller shall inform the data subject of the reasons for not taking action within one month of receipt of the request.
In accordance with the GDPR, controllers must use all reasonable measures to verify the identity of a data subject who requests access, and, in general, of data subjects that exercise the remaining ARCO rights.
When the controller processes a large quantity of information concerning a data subject, the controller may request that the data subject specify the information to which the request relates.
The controller may be assisted by processors to respond to requests made by data subjects exercising their rights, and such assistance may be included in the processing agreement.