Data Subject Rights

What are the data subjects' rights?

By making a written request to the eu-LISA Data Protection Officer (DPO), data subjects (individuals whose data is being processed) have the right to:

access the data processed, collected and used concerning themselves;
rectify the information in case of inaccuracy and incompleteness;
block inaccurate data collected;
erase unlawful data collected;
object to the processing of your personal data and/or the conduction of profiling activities;
withdraw their consent if it no longer represents the legal basis of the processing;
be informed in case personal data is disclosed to any third party.

The Regulation (EC) 45/2001 grants data subjects with rights aiming at insuring their rights to privacy and data protection.

When eu-LISA processes personal data, data subjects have the right to be informed of the processing. The data controller must provide the following information, before the time of collection:

the identity of the controller;
the purpose of the processing;
the legal grounds of the processing operation;
the time of data retention;
the recipients of the data;
the rights of the data subjects and how they can be exercised.

How can data subjects exercise these rights or make a complaint?

If data subjects want to exercise their rights or if they have any questions related to the processing of their personal data by eu-LISA, they can address a question directly to eu-LISA using the contact form.

If data subjects consider that their rights have been infringed by eu-LISA when it processes data relating to them, they can lodge a complaint to eu-LISA's DPO or directly to the European Data Protection Supervisor (EDPS).

How can a complaint be submitted to eu-LISA's DPO?

A complaint can be lodged to eu-LISA's DPO using the complaint submission form. This form can be completed electronically. All relevant information needs to be included in the complaint form. To avoid unnecessary delay, any evidence supporting the allegations needs to be attached (email exchanges, letters, screenshots, etc.).

Before lodging a complaint, please be aware of the following:

The processing of personal data carried out by national authorities or private entities falls outside the competence of eu-LISA's DPO and that of the EDPS. eu-LISA's DPO is only competent to deal with complaints against eu-LISA.
Complaints can only relate to the processing of personal data and the violation of rights related to the protection of personal data.
Complainants are recommended to contact the EDPS only after having first contacted the data controller and/or eu-LISA's DPO. However, data subjects can directly lodge a complaint to the EDPS, if this is deemed necessary.
Any complaint related to Eurodac, SIS II or VIS should be treated by the competent National Supervision Authorities. In this regard, please refer to the complaint procedure .

Personal data will only be used and stored to the extent necessary to reply to the query. eu-LISA's DPO will make his or her best efforts to provide an answer within a reasonable time, within a period that will not exceed 3 months.

If the data subject is not satisfied with the reply of eu-LISA's DPO, he or she has the right of recourse at any time to the EDPS. The EDPS is an independent supervisory authority established in accordance with Regulation (EC) 45/2001, responsible for ensuring that the fundamental rights and freedoms of natural persons, in particular the rights to privacy and data protection, are respected by the European Union institutions and bodies. Therefore, if data subjects consider that their personal data has been misused by eu-LISA, they can launch a complaint to the EDPS. The EDPS, after assessing the admissibility, will carry out an inquiry and take appropriate measures to solve it. For more information regarding the EDPS, please refer to the EDPS website.

Exercise your rights or lodge a complaint related to the Eurodac, SIS II or VIS systems

eu-LISA is the European Union Agency that provides technical and operational expertise in order to manage the Eurodac System, the Schengen Information System II (SIS II) and the Visa Information System (VIS) amongst others. However, eu-LISA does not access the information in Eurodac records, SIS II records or VISA applications.

National authorities of the Member States and Associated Countries directly manage the information for which they are responsible.

For this reason, if the data subject wants to exercise his/her rights (information, access, rectification, blocking, erasure, and/or objection) regarding one of the large-scale IT systems, the complaint or the request should be addressed to the national data protection authority of the involved Member State or supervisor authorities.

More information can be found at the following link: