A/79/173 be processed, the extent of the processing, the data storage period and the accessibility of the data. 17. Precautionary principle If there is a lack of certainty regarding the potential harm to the data subject or to society that may result from the processing of personal data, the data controller or data processor must, in order to avoid causing serious and irreversible harm, refrain from carrying out the processing or take precautionary or preventive measures to protect the rights of the data subject, his or her human dignity and other human rights. The precautionary principle also applies when the risks or the extent of the harm that would or might result are not known in advance because there is no way of determining the effects that the data processing would have in the medium or long term. 18. Principle of favourable or prevailing interpretation In case of doubt regarding the interpretation and application of these principles, the interpretation most favourable to the data subject shall prevail. 19. Principle of self-regulation The data controller may, on a voluntary basis, join binding self -regulation schemes that are aimed at, inter alia, contributing to the proper application of the present principles and establishing procedures for resolving conflicts between data controllers and data subjects, without prejudice to other mechanisms that may be established by the applicable national law on the matter, taking into account the specific characteristics of the personal data processing, as well as the effective exercise of and respect for the rights of the data subject. For the purposes of the preceding paragraph, codes of ethics and certification systems with their respective trust seals may be developed to contribute to the achievement of the objectives set forth in this article. 20. Principle of effective protection of the rights of subjects of personal data Useful, effective, simple and expeditious mechanisms shall be adopted to guarantee that subjects of personal data have the right to the following: access, rectification, deletion (erasure), objection, portability, not be the object of automated decision-making that produces legal effects for or significantly affects them, and compensation for damage suffered by them as a result of improper processing of their information. In addition to the judicial or administrative actions provided for in national regulations, the use of alternative dispute resolution methods for disputes concerning the processing of personal data shall be promoted. 21. Supervision and sanctions Each State must designate the authority which, in accordance with its domestic legal system, is to be responsible for supervising observance of the principles set forth in the present resolution. This authority must offer guarantees of impartiality, independence vis-à-vis persons or agencies responsible for processing and establishing data, and technical competence. In the event of violation of the provisions of the national law implementing the aforementioned principles, criminal or other penalties must be envisaged, together with the appropriate individual remedies. The authority shall have full autonomy and shall not be subject to any external influence, direct or indirect, and it shall not request or accept any order or 24-13146 21/23