On Limitations to Data Subject Rights
These rights are NOT available if the purpose of the processing is: (a) For scientific and statistical research, AND no decisions are taken regarding the data subject; and (b) For the purpose of investigations in relation to any criminal, administrative, or tax liabilities of a data subject.
These limitations shall only be to the MINIMUM EXTENT NECESSARY to achieve the purpose of said research or investigation.
The PIC shall use reasonable measures to verify the identity of the requesting data subject. For this purpose, the PIC may require the presentation of supporting documents to verify the identity of the requesting party, ensuring that the requested information is only to the extent necessary to confirm such identity.
Generally, PICs shall not charge any fee to fulfill the exercise of data subject rights. As an exception, where data subjects request copies of their personal data and the other information in exercising their right to access, the PIC may require reasonable fees to cover administrative costs: provided, that fees imposed shall not be so exorbitant or excessive as to have the effect of discouraging such requests.
The PIC must comply with requests without undue delay: provided, that the period will not exceed thirty (30) working days after receipt of the request and/or the necessary supporting or additional documentation: provided further, that if a request is complex or numerous, compliance with such request may be extended for a period not exceeding another fifteen (15) working days: provided finally, that the data subject or his or her authorized representative is notified of the reason for the extension.
PICs shall not retain personal data for the sole purpose of making it available for potential future requests for the right to access or data portability. Personal data shall be retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained.