The ITM respects your rights to determine how your personal data are used. Specifically, this right can be broken down as follows:
Right of access by the data subject
You have a right to obtain from the ITM confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the information provided in Article 15 of the GDPR.
Right of rectification
If your personal data are inaccurate or incomplete, you have the right to ask the ITM to rectify them. If the ITM has forwarded them to a third party, the ITM will notify them of the rectification.
Right to object to processing
In principle, you can object to the use of your personal data by the ITM, which will take into account your right to object and determine whether the processing of your data unfairly harms you in a way that forces the ITM to bring it to an end.
However, you cannot object to the processing of your personal data when the law requires the ITM to carry out the processing, if your data are necessary for the exercise of its powers, even if you oppose this.
Right to restrict processing
You have the right to ask the ITM to limit the use of your personal data by the ITM, under the conditions provided for in Article 18 of the GDPR.
Right to be forgotten
You have the right to ask the ITM to erase your personal data if there is no longer any legitimate reason for retaining them.
Right to withdraw your consent at any time.
Right to complain
If you have a complaint relating to the processing of your personal data, or if you suspect a potential breach of the security of your personal data, you can consult the complaints procedure published on the ITM website and/or contact the ITM by contacting the Data Protection Department (Service Protection des Données), BP 27, L-2010 Luxembourg, e-mail: protection.donnees@itm.etat.lu, subject to compliance with the identity verification procedure described below.
You are also entitled to lodge a complaint with the national supervisory authority for the protection of personal data, the National Commission for Data Protection (Commission Nationale pour la Protection des Données - CNPD), whose registered office is at 15, Boulevard du Jazz, L-4370 Belvaux, www.cnpd.lu; complaints may also be lodged with the competent courts.
Notification of a personal data breach to the supervisory authority and communication to the data subject.
Any personal data breach will be notified by the ITM to the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after the ITM having become aware of it, unless the personal data breach in question is unlikely to result in a risk to the rights and freedoms of natural persons.
When a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person, the controller shall communicate this personal data breach to the data subject without undue delay, unless this communication is not required by virtue of Article 34(3) of the GDPR.
Exercise of your rights
To exercise your rights, you can consult our website, go to the ITM’s premises or make a phone call.
The ITM will respond without undue delay and in any event within one month of receipt of your request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. If the ITM needs more time to process your request, it will inform you of such extension within one month of receipt of the request.
If the ITM does not take action on your request, the ITM will inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action.