You can call us for guidance on general questions within the scope of our assignment. However, we cannot provide legal advice or give binding decisions in our replies.
Our guidance is intended to provide general information about the applicable regulations and how they are applied within our areas of responsibility. We can therefore explain the legislation and how it is generally to be interpreted. However, we cannot provide legal advice or give binding statements in our responses.
If someone processes your personal data incorrectly
If you have questions about, or views on, how an organisation processes your personal data or conducts camera surveillance, you should contact them first. If you do not receive a response or if you suspect that they are processing your personal data incorrectly, you can submit a complaint with us at IMY.
Here are some examples of what we can and cannot answer when it comes to individuals.
We can answer general questions about your rights under the General Data Protection Regulation (GDPR).
We cannot answer:
whether an organisation has processed your personal data unlawfully.
We can explain how to exercise your rights under the GDPR. We cannot exercise your rights for you.
We cannot answer:
what the contact details of the data controller are.
who the data controller is.
IMY supervises, among other things, compliance with the Camera Surveillance Act and the GDPR. We can therefore explain what the legislation says about when camera surveillance is permitted.
We cannot answer:
whether a specific instance of camera surveillance is lawful or not.
whether the private use exemption applies in a specific case.
IMY is the supervisory authority for the Credit Information Act and we grant licences to those wishing to provide credit information services. We can only provide general information about the Credit Information Act.
We cannot answer:
whether a credit report obtained about you was lawful.
whether you have a payment default.
IMY cannot delete your personal data
IMY cannot delete your personal data for you. To have your personal data erased, you must contact the data controller directly and request erasure.
Here are some examples of what we can and cannot answer when it comes to organisations.
We can explain the general requirements under the Camera Surveillance Act and the GDPR for camera surveillance to be lawful.
We cannot answer:
whether your planned camera surveillance is permitted or not.
We can explain the general rules that apply to companies, public authorities and other organisations that process personal data.
We cannot answer:
specific questions, such as which legal basis can be used for a particular processing activity involving personal data.
whether certain security measures are sufficient for a particular organisation.
whether a particular IT service or software complies with the requirements of the GDPR.
whether a transfer of personal data to another country is lawful.
questions that require an extensive legal assessment.
We can explain the obligations that apply to organisations when handling personal data breaches under the GDPR.
We cannot answer:
whether it is a data breach that must be reported.
whether you must inform the data subjects.
Our website is organised according to whether you are looking for information as an individual or representing an organisation. Here are some links to pages containing information that many people ask about.
We often receive questions about areas that do not fall within our areas of responsibility. We cannot answer these questions, but we can direct you to the appropriate authority or organisation where you can obtain an answer.