Since 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”) is applicable in all EU member States, including Luxembourg.
This regulation aims to strengthen data subjects’ rights (i.e. persons of whom the Directorate of Civil Aviation processes personal data) concerning the processing of their personal data.
Right of access, to rectification, to erasure, restriction to processing and to object
Data subjects have several rights they can assert:
- Right of access (article 15 GDPR)
Every person has the right to obtain from the DAC confirmation as to whether or not personal data concerning him or her are being processed. Where that is the case, the data subject has the right to access to the personal data and ask for a copy of the personal data undergoing processing.
- Right to rectification (article 16 GDPR)
- Right to erasure (article 17 GDPR)
The data subject has the right to obtain from the DAC the erasure of personal data concerning him or her in the following cases:
− the personal data are no longer necessary in relation to the purposes for which they were collected,
− the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or
− the personal data have been unlawfully processed.
This erasure is not possible in case of a legal obligation for the DAC which requires processing of this personal data or in case of a task carried out in the public interest or in the exercise of official authority vested in the DAC (e.g. continuous supervision missions by the DAC).
- Right to restriction of processing (article 18 GDPR)
The data subject has the right to obtain from the DAC restriction of processing in the following cases:
− the accuracy of the personal data is contested by the data subject (the restriction is valid for a period enabling the DAC to verify the accuracy of the personal data),
− the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead, or
− the DAC no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
In such a case, personal data shall only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
- Right to object to processing (article 21 GDPR)
The data subject has the right to object to processing by the DAC of personal data concerning him or her on grounds relating to his or her particular situation. However, the DAC can continue to process these personal data on the basis of compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Right to information
In addition to these specific rights, data subjects have the right to obtain detailed information on the specific processing of personal data concerning him or her, by means of a specific “information note”.
These information notes include precise and concrete information on the data processing, and are published in annex to this page.
Data Protection Officer
Any questions relating to data protection as well as any requests concerning the data subject’s rights shall be addressed to DAC’s Data Protection Officer (DPO). Proof of identity has to be included in the request (ex. copy of identity card or passport, licence number, etc.).