GDPR Individuals Rights
The GDPR provides the following rights for individuals:
- The right to be informed
- The right of access
- The right to rectification
- The right of erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
The school will ensure that all parents/carers and school staff are aware of these rights via the school privacy notices. Also, the school will ensure that should any parent/carer or member of school staff request to invoke any of the rights listed above that they will treat the request in the correct manner and assist the individual anyway it can.
However, some of the rights listed will not apply due to other conditions set. An example would be the right to erasure, as if the individual requested this to happen to a record, then this could hamper the schools ability to perform its public task. As such, any requests that are made will be treat on a case by case basis, and the requester will be kept informed at all times around the decisions that the school make regarding their request.
Below is a brief guide to what each of the rights are:
- The right to be informed – The right to be informed encompasses your obligation to provide ‘fair processing information’, typically through a privacy notice. It emphasises the need for transparency over how you use personal data.
- The right of access – Individuals have the right to access their personal data and supplementary information. The right of access allows individuals to be aware of and verify the lawfulness of the processing.
- The right to rectification – The GDPR gives individuals the right to have personal data rectified. Personal data can be rectified if it is inaccurate or incomplete.
- The right to erasure – The right to erasure is also known as the ‘right to be forgotten’. The broad principal underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
- The right to restrict processing – Individuals have the right to ‘block’ or suppress processing of personal data. When processing is restricted, you are permitted to store the personal data, but not further process it. You can retain just enough information about the individual to ensure that the restriction is respected in future.
- The right to data portability – The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy, or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability.
- The right to object – Individuals have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise or official authority (including profiling). Direct Marketing, and processing for purposes of scientific/historical research and statistics.
- Rights related to automated decision making including profiling – This is not applicable to schools. However, should an individual challenge the school in any way regarding automated decision making, then the school will carry out an investigation.