1 Any person may request information from the controller on whether personal data relating to them is being processed.
2 The data subject shall receive the information required to be able to exercise their rights under this Act and to guarantee transparent data processing. In every case, they are entitled to the following information:
- a.
the identity and the contact details of the controller;
- b.
the processed personal data as such;
- c.
the purpose of processing;
- d.
the retention period for the personal data or, if this is not possible, the criteria for determining this period;
- e.
the available information about the source of the personal data, if it has not been collected from the data subject;
- f.
if applicable, whether an automated individual decision has been taken and the logic behind the decision;
- g.
if applicable, the recipients or the categories of recipients to which personal data is disclosed, as well as the information specified in Article 19 paragraph 4.
3 The data subject may consent to having personal data relating to their health communicated by a health profession of their choice.
4 If the controller arranges for personal data to be processed by a processor, it remains under a duty to provide information.
5 No one may waive their right to information in advance.
6 The controller must provide information free of charge. The Federal Council may provide for exceptions, in particular if the effort required is disproportionate.
7 The information shall in general be provided within 30 days.