Right of access
The right of access, described in article 18 of the LQPD, is your right to contact the controller to find out whether or not they are processing your personal data and, in the event that this processing is being carried out, obtain the next information:
• A copy of your personal data that is the object of processing.
• The purposes of the processing.
• The categories of personal data that are processed.
• The recipients or categories of recipients to whom the personal data have been communicated or will be communicated, in particular, recipients in third countries or international organizations.
• The expected period of conservation of the personal data, or if this is not possible, the criteria used to determine this period.
• The existence of the right of the data subject to request from the controller: the rectification or deletion of their personal data, the limitation of the processing of their personal data or the opposition to this processing.
• The right to file a claim with a Control Authority (in Andorra, the APDA).
• When the personal data has not been obtained directly from you, any available information about its origin.
• The existence of automated decisions, including profiling, and at least in such cases, significant information on the logic applied, the importance and the expected consequences of this processing for the data subject.
• When personal data is transferred in a third country or to an international organization, you have the right to be informed of the appropriate guarantees in which the transfers are made.
You can download the form to exercise it here.
The possibility of receiving consistent, reliable, complete and up-to-date information about processing activities enables individuals to obtain and/or increase their awareness of any relevant processing operations, exercise practical control over their data, and control the accuracy and lawfulness of the data processing. This information is a key principle of the entire Andorran data protection framework, and must be provided in accordance with article 18 of the LQPD. More specifically, the data controller is obliged to provide transparent, intelligible and easily accessible information on whether or not data is being processed, what the actual processing operations are, as well as full access to the data being processed.
The right of access in accordance with article 18.1 of the LQPD includes three components:
1. the right to obtain confirmation from the data controller as to whether data concerning you is being processed,
2. the right to obtain access to the data subject to processing and,
3. The right to obtain information on certain aspects of the processing, as indicated in the list of article 18.1, points a) to h), of the LQPD (or in the above description).
The LQPD (as well as the European Data Protection Regulation, the GDPR) does not impose any requirement regarding the form of the request through which the data subjects or their authorized representative exercises the right of access. The form provided above is only a tool to facilitate the exercise, but no one is obligated to use it.
The data subject can define the scope of her request and does not need to indicate the reasons. Even if he did, the controller does not have the jurisdiction to assess the reasons for it.
Even so, if the request is not clear and a large amount of data is being processed, the controller may ask the data subject to specify which processing activities the request relates to. If the data subject still requests access to all of her personal data, the data controller has to provide this information, as confirmed by the EDPB (European Data Protection Board) and national courts in several EU countries.
The controller has to take all necessary steps to verify the identity of the data subject, since the disclosure of personal data to another person could qualify as a data breach. However, the controller will not use this requirement to hinder the exercise of the right of access, nor is it acceptable to request an identification document in the access request when it is not necessary to authenticate the identity of the requester. For example, when the interested party sends an access request from the same email that he used when he first provided his personal data, there can be no doubt about his identity and, therefore, any other data that the controller requires the data subject to present, as a prior condition to meet your request, is disproportionate, violates the principle of data minimization and, ultimately, would be illegal.
Last updated: May 17, 2022