The Data Protection Law requires obtaining the consent of data subjects for the processing of their personal data. According to the Data Protection Law, the consent of the data subject means the voluntary and intentional expression of will of the data subject to the processing of personal data for the identified purposes, expressed in writing or in some other form. In the area of e-commerce, consent may be granted in the process of registration of data subjects by "ticking" a consent box during registration, provided that such a system does not allow processing of personal data before the consent is obtained. Under certain circumstances, personal data may be processed without a data subject’s consent (eg. legislative permission for processing of personal data, necessary to the conclusion and execution of a transaction or contract in favor of the data subject, protection of interests of data subject or data owner).

Pursuant to the Data Protection Law, as a general rule, personal data subjects shall be informed, at the moment of collection of their personal data of:

• The owner of their personal data;
• The composition and content of their personal data being collected;
• Their rights;
• The purpose of their personal data collection; and
• The persons to whom their personal data will be transferred.

However, in cases when the personal data of individuals have been collected based on the following grounds, the personal data subjects shall be informed of the above within 30 working days from the:

• Legislative permission of the owner of the personal data on the processing of personal data exclusively for the purposes of fulfilling its authorities;
• Conclusion and execution of a transaction where the data subject is a party or the transaction has been concluded in favor of the data subject, which preceded conclusion of a transaction at the request of the subject of personal data;
• Protection of vital interests of the data subject; or
• Need to protect the legitimate interests of the owner of personal data and third parties, except where a data subject requests that the processing of his / her personal data stops and the need to protect personal data prevails over such interest.

In addition, the Data Protection Law provides the data subject with the following rights:

• To be aware of the sources of collection, location of his / her personal data, the purpose of data processing, the address of the owner or processor of the personal data or to obtain the said information through his / her representatives;
• To obtain information in regards to the conditions of providing access to personal data, and in particular, information on third parties, to which his / her personal data are transferred;
• To access his / her personal data;
• To obtain a reply within 30 calendar days from the date of the receipt of his / her request, informing the individual whether his / her personal data is being processed and to receive the contents of such personal data;
• To provide the owner of personal data with the reasonable request to terminate the processing of his / her personal data;
• To provide a reasonable request to change or destroy his / her personal data by any owner and processor of the personal data if the data is processed illegally or is inaccurate;
• To protect of his / her personal data from unauthorized processing and accidental loss, elimination or damage with respect to intended encapsulation, not providing or the untimely provision of personal data, and to protect from providing invalid or discrediting information regarding the individual;
• To appeal violations in the course of personal data processing to the Ombudsman or to the court;
• To introduce limitations as regards rights on its personal data processing while giving the consent;
• To use the means of legal protection in the case of violation of rights to personal data;
• To revoke its consent on personal data processing;
• To be aware of the mechanism of automatic personal data processing; and
• To be protected from the automated decision that has legal effects.

The owner of the personal data can entrust the processing of personal data to the processor pursuant to a written agreement requiring that the processor process the personal data only for the purposes and in the amount permitted under the agreement. The transfer of personal data to the processor is permitted only with consent of the data subject.