13. Individual's Rights
13.1. GDPR gives individuals more control about how their data is collected and stored and what is done with it. Some existing rights of individuals have been expanded upon and some new rights have been introduced. It is extremely important that Colleges plan how they will handle these requests under GDPR.
13.2. The different types of rights of individuals are reflected in this paragraph.
13.3. Subject Access Requests
13.3.1. Individuals have the right under the GDPR to ask a College to confirm what Personal Data they hold in relation to them and provide them with the data. This is not a new right but additional information has to be provided and the timescale for providing it has been reduced from 40 days to one month (with a possible extension if it is a complex request). In addition, you will no longer be able to charge a fee for complying with the request.
13.3.2. Subject Access Requests are becoming more and more common and are often made in the context of a dispute which means that it is crucial that they are handled appropriately to avoid a complaint being made to the ICO.
If you wish to make a subject access request, please contact firstname.lastname@example.org. Requests can also be made to:
Executive Director Workforce Development
13.4. Right of Erasure (Right to be Forgotten)
13.4.1. This is a limited right for individuals to request the erasure of Personal Data concerning them where:
22.214.171.124. the use of the Personal Data is no longer necessary;
126.96.36.199. their consent is withdrawn and there is no other legal ground for the processing;
188.8.131.52. the individual objects to the processing and there are no overriding legitimate grounds for the processing;
184.108.40.206. the Personal Data has been unlawfully processed; and
220.127.116.11. the Personal Data has to be erased for compliance with a legal obligation.
13.4.2. In a marketing context, where Personal Data is collected and processed for direct marketing purposes, the individual has a right to object to processing at any time. Where the individual objects, the Personal Data must not be processed for such purposes.
13.5. Right of Data Portability
13.5.1. An individual has the right to request that data concerning them is provided to them in a structured, commonly used and machine readable format where:
18.104.22.168. the processing is based on consent or on a contract; and
22.214.171.124. the processing is carried out by automated means
13.5.2. This right isn’t the same as subject access and is intended to give individuals a subset of their data.
13.6. The Right of Rectification and Restriction
13.6.1. Finally, individuals are also given the right to request that any Personal Data is rectified if inaccurate and to have use of their Personal Data restricted to particular purposes in certain circumstances.
13.7. The College will use all Personal Data in accordance with the rights given to Individuals’ under Data Protection Laws, and will ensure that it allows Individuals to exercise their rights in accordance with the College’s Rights of Individuals Policy and Rights of Individuals Procedure. Please familiarise yourself with these documents as they contain important obligations which College Personnel need to comply with in relation to the rights of Individuals over their Personal Data.