How to bring the person responsible to administrative and criminal liability for the unlawful processing of your data?
You have the right to access your personal data that the processing managers (business entities/companies/organizations/state bodies) collect about you and you can request detailed information about their purpose of processing, about the type/categories of personal data that are processed.
To exercise your rights, you should contact the company or organization that processes your personal data, i.e. the manager/executor of the processing. The company/organization must respond to your request without undue delay, and within one month at the latest. If the company/organization does not want to comply with your request, it must provide a valid reason.
If the data controller has not complied with your request, and you believe that your right to the protection of personal data has been violated, contact the Personal Data Protection Agency with a request to determine the violation of rights.
Administrative offence
If a person has unlawfully processed your personal data, you have the right to request the deletion of personal data from the controller (organization, company). You can also request the initiation of administrative violation proceedings by submitting an application to the Agency. In your application, you should indicate the kind of unlawful actions the data user has carried out, provide substantial arguments and explain the kind of harm that it has created for you.
The Agency may decide to start administrative violation proceedings and in such a situation will contact you and inform you about your right to be recognized as a victim in the case.
If, during the supervision of the Agency, knowledge is gained that indicates a criminal offense, the authorised persons shall inform the competent police station or a state attorney.
Additionally, a fine can be imposed on the processor, a legal entity that is not a public authority, that unlawfully processed your personal data.
Criminal offence
If your data has been collected, stored or otherwise used unlawfully and it has caused you substantial harm, this action may reach the level of a criminal offence. Substantial harm comprises not only a breach of your right to control the use of your personal data but also a significant financial loss, which has been thereby caused to you. In such a situation, you should initiate criminal proceedings by submitting an application to an investigating institution or the prosecutor’s office.
In your application, you should indicate the kind of unlawful actions the person in question has carried out, provide substantial arguments and explain the kind of harm that it has created for you.
The investigator or prosecutor may decide to start criminal proceedings and in such a situation will contact you and inform you about your right to be recognized as a victim in the case and to request compensation for the material loss and the moral injury you have suffered.