What the Constitution Protects
Article 21 protects personal data against unlawful collection, processing, storage, and use, including with digital technologies. Consent, other lawful grounds for processing, retention periods, biometric data, and deletion procedures are governed by specific legislation.
What to Do When Data Are Leaked
- Preserve evidence: screenshots, page addresses, messages from the organisation, the date, and the circumstances of discovery.
- Contact the data owner or operator: request an explanation, cessation of unlawful processing, and deletion or correction where the law provides for it.
- Submit a complaint through eOtinish to the authorised body: supervision is handled by the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development.
- Provide verifiable details: the organisation or person involved, the circumstances of the violation, and available evidence. These are needed for an unscheduled inspection or administrative proceedings.
- Contact law enforcement if there are signs of fraud, extortion, unlawful access, or another crime.
- Go to court if you need the violation stopped or proven harm compensated.
The Constitutional Court reviews not the leak itself, but the constitutionality of a legal norm that directly affects your rights. The citizen application mechanism has operated since 2023.