GDPR introduces eight rights that a data subject has over the personal identifiable data processed about them. For all data stored by the University these principles should be considered and adhered to. Failure to comply with GDPR could result in the ICO imposing fines of up to 4% of annual global turnover or €20 million whichever is the greater.
The GDPR rights for individuals are:
The Right to be Informed - The Data Subject's right to be provided with clear information about what data is being processed, why it is processed and how their data will be processed. (Articles 12, 13 & 14)
The Right of Access – which is right to ask a Data Controller for all the Personal Data they hold concerning them – free of charge (Article 15).
The Right to Rectification – allows for inaccurate or incomplete information to be corrected (Article 16).
The Right to Erasure (to be forgotten) – this is the right to request that data be erased from our systems 'without undue delay' (Article 17).
The Right to Restrict Processing – individuals can ask us to cease processing their data and preserve is "as is" pending action against us (Article 18).
The Right to Data Portability – which is the right to receive back from a data controller a reusable electronic version of any information submitted to them electronically (Article 20).
The Right to Object – to certain types of processing, including direct marketing and profiling, processing under legitimate interests or for scientific/historical research and statistics (Article 21).
Right not to be subject to a decision based solely on automated processing*, including profiling**, which produces legal effects or significantly affects him/her (Article 22).
*Automated Processing is where a system uses data to make a decision about an individual, without any input from a human.
** Profiling is any form of automated processing of personal data used to evaluate, analyse or predict certain personal aspects of a natural person.
