Request to exercise the right of access
Organic Law number 63 dated July 27, 2004 on the protection of personal data (GDPR):
Art. 37. « The person responsible for the automated processing of personal data and the subcontractor must implement the technical means necessary to allow the person concerned, their heirs or their guardian to send their request for rectification electronically, modification, correction, or erasure of personal data. »
Art. 32. « For the purposes of this law, the right of access means the right of the person concerned, their heirs or their guardian to consult all personal data concerning them, as well as the right to have them correct, complete, rectify, update, modify, clarify or deletewhen they prove to be inaccurate, equivocal, or their processing is prohibited. The right of access also covers the right to obtain a copy of the data in a clear language consistent with the content of the records, and in an intelligible form when processed using automated processes.»
Art. 40. « The person concerned, their heirs or their guardian, may request rectify lpersonal data concerning hercomplete, modify, clarify, update, delete themwhen they prove to be inaccurate, incomplete, or ambiguous, or request their destruction when their collection or use has been carried out in violation of this law. It may also request, free of charge and after completion of the required procedures, the issuance of a copy of the personal data and indicate what has not been done with regard to these data. In this case, the data controller or processor must provide a copy of the requested data within a period not exceeding one month from the date of presentation of the request. In the event of refusal, explicit or implicit, of the request, the Authority may be contacted within a period not exceeding one month from the date of expiry of the period mentioned in the previous paragraph. »
Art. 11. « (…) The data controller must also ensure that this data is accurate, precise and updated.»
Art. 34. « The right of access is exercised by the person concerned, their heirs or guardian at reasonable intervals and not excessively. »
Art. 36. «When there are several persons responsible for the processing of personal data or when the processing is carried out by a subcontractor, the right of access is exercised with each of them »
The right of rectification allows you to correct inaccurate data concerning you (incorrect age or address) or to complete data (address without the apartment number) in relation to the purpose of the processing.
The right of access allows you to obtain a copy of the data in a clear language and consistent with the content of the records, and in an intelligible form when processed using automated processes.
The Law puts the burden on of the person responsible for the file the obligation to communicate to other recipients of the data the corrections made, unless such communication would require disproportionate effort.
Processing your personal data despite your opposition is punishable by one year's imprisonment and a fine of 5,000 dinars.
WHAT YOU CAN DO
Send a letter or e-mail to the company's data controller.
You must prove your identity, for example, by:
Communiquant votre numéro de client ou d’abonnement en plus de votre identité et de votre adresse.
Exerçant vos droits à partir d’un compte en ligne sur lequel vous vous êtes préalablement authentifié (identifiant et mot de passe).
Only if the company has doubts about your identity can it ask you for additional information, including a copy of an identity document.
Keep a copy of your procedure (copy of the letter, screen copy, etc.). Do not hesitate to ask for an acknowledgment of receipt to prove the date.
Depending on your request, you must receive a response within one month. This deadline can be extended by one month and therefore increased to two months if the request is complex, but the company must justify it.
Silence maintained for more than ... months constitutes a decision of refusal, unless there are justifications extending this deadline.
In the absence of a response within the time limit or an incomplete response, or even in the event of refusal, you have the possibility of filing a complaint with the INPDP in accordance with Art. 38. « In the event that the data controller or subcontractor refuses to allow the data subject, his or her heirs or guardian to consult the requested personal data, or defers access to these data, or refuses to issue a copy of this data, the person concerned, his heirs or his guardian may submit a request to the Authority in a maximum period of one month from the date of refusal. »
Envoyée par mails sur l’adresse: inpdp@inpdp.nat.tn.
Faxée à l’Instance sur le numéro: 71 799 823
Envoyée par la poste sur l’adresse: 1, Rue Mohamed Moalla, 1002, Mutuelleville, Tunis B.P. 525.
The Authority must render its decision within one month from the date of referral.
«The authority, after hearing both parties and carrying out the necessary investigations, may order consultation of the required information or the delivery of a copy of this information or approval of the refusal, within a period not exceeding one month from the date of referral. The person concerned, his heirs or his guardian may submit a request to the Authority, where applicable, in order to take all appropriate measures to prevent the destruction or concealment of personal data. The authority must rule on the request within seven days from the date of submission of the request. The destruction or concealment of this data is prohibited upon presentation of the request.»
To note
The model request to exercise the right of opposition that we provide to you has been drawn up as an example.
Limitation of the right of accessof the data subject, his heirs or guardian to personal data concerning him is only possible in the following cases:
Lorsque le traitement des données est effectué à des fins scientifiques et à condition que ces données n’affectent la vie privée de la personne concernée que d’une façon limitée.
Si le motif recherché par la limitation du droit d’accès est la protection de la personne concernée elle-même ou des tiers.
Attention : The model request to exercise the right of opposition is not intended to replace the personalized advice that could be provided to you. Its purpose is to offer you an argument that you consider relevant to your situation.
