Owners' Rights Over Their Personal Data

Every owner, like any data subject, has precise rights over their personal data: access, rectification, erasure, restriction, objection and portability where applicable. The manager, as controller or processor depending on the case, must act on these requests without undue delay and, as a rule, within one month. Knowing what these rights are and how to handle them in practice avoids conflicts and possible complaints to the Garante.

The rights provided by the GDPR

EU Regulation 2016/679 grants the data subject a set of rights exercisable against the controller. The right of access lets them know whether and which data is processed and obtain a copy. Rectification allows correcting inaccurate data or completing it. Erasure, within the limits seen for retention obligations, allows removal of data no longer necessary. Restriction temporarily blocks processing in case of a dispute. Objection allows opposing processing based on legitimate interest.

• Access: know which data is processed and obtain a copy
• Rectification: correct or complete inaccurate data
• Erasure: removal of data no longer necessary, subject to legal obligations
• Restriction and objection: block or contest a processing operation

Access is the most requested right

In a condominium the most frequent request is access to one's own data. The owner can ask which information concerning them is processed, for which purposes, for how long it will be kept and to whom it has been disclosed. The manager must provide a clear response and, if requested, a copy of the data. Beware, however: the right of access concerns the data subject's data, not that of other owners. Providing a document that also contains third-party data requires redacting or not disclosing the parts that do not concern them.

Distinguishing access from consulting condominium documents

The request for access to one's own personal data under the GDPR must be kept distinct from the owner's right to inspect and obtain copies of the condominium's accounting and management documentation, which is grounded in condominium law. These are different planes: the first concerns the data subject's personal data, the second the transparency of management toward all owners. The manager must recognize the nature of the request to respond on the correct track, without confusing the two regimes.

Response deadlines

The controller must respond without undue delay and in any case within one month of the request. The deadline can be extended by two further months for particularly complex or numerous requests, informing the data subject within the first month and explaining the reasons for the delay. The response is generally free. Only for manifestly unfounded or excessive requests, for example repetitive ones, may the controller charge a reasonable fee or refuse, giving reasons.

Verifying the requester's identity

Before providing personal data, the manager must ascertain that whoever requests it is actually the data subject or their legitimate representative. Handing data to the wrong person would itself be a breach. Verification must be done with proportionate measures, without asking for more information than necessary. It is good practice to handle requests through an identifiable channel, for example the mailbox in the data subject's name or an authenticated restricted area.

Keeping track of requests

Managing data subject rights also means documenting the requests received and the responses provided, with their dates. This traceability demonstrates compliance with deadlines and is useful in case of an audit. A register of requests, even a simple one, helps the firm not miss deadlines and respond consistently. The accountability required by the Regulation is also built on such operational details.

Responding in an orderly and timely way

To respond well to an access or rectification request you need to retrieve an owner's data quickly, know where it is stored and to whom it has been disclosed. Management software that keeps registers, accounting and communications linked by condominium makes this search immediate and reduces the risk of exposing third-party data. AmministraPro organizes condominium data in a structured way: the features are described on the /funzioni page and the plans on the /prezzi page, so you can handle owners' rights promptly and in order.