Data Protection: Your Rights
The Data Protection Act gives a number of rights to data subjects e.g. students, staff etc. These rights are:-
Right of subject access
You have the right to be told by the University whether it or someone else on its behalf is processing your personal data and if so, to be given a description of the personal data, the purposes for which they are being processed and the likely recipients and sources of that personal data. You are also entitled to receive a copy of this personal data. All requests for access must be made in writing to the Data Protection Officer and the University may charge a fee of £10 per request. The University will respond promptly to such a request and certainly within forty days. (See Subject Access Procedure for more information)
Right to prevent processing likely to cause damage or distress
You are entitled to request, in writing, that the University does not process personal data where such processing is likely to cause substantial damage or substantial distress to you or another person. There are a number of provisos to this right, in particular:-the damage or distress must be "unwarranted"; or the processing can not be necessary for fulfilling a contract with you, for fulfilling a legal obligation of the University; or for protecting your vital interests.
Right to prevent processing for purposes of direct marketing
You are entitled to request in writing that the University does not process personal data for the purposes of direct marketing.
Rights in relation to automated decision taking
You are entitled, by writing, to request that the University ensures that no decision that significantly affects you is based solely on the processing of personal data by automatic means. An obvious example of automated decision taking is where the decision to reject interviewees is made by computer on the basis solely of psychometric testing. Where a decision which significantly affects you is based solely on such automatic processing, the University must notify you that the decision was taken on that basis as soon as reasonably practicable. Note, though, that any human intervention or discretion will mean that the automated decision-taking provisions do not apply.
Right to compensation
If you suffer damage or distress as a result of the University’s breach of any of the requirements of the new Act, you may be entitled to compensation.
Rectification, blocking, erasure, destruction
You may apply to the Court for an order requiring the University to rectify, block, erase or destroy data relating to you if they are inaccurate. Please contact us if you believe information we hold is incorrect.
Requests for assessment
You may request that the Information Commissioner assesses whether or not it is likely that any processing of personal data has been or is being carried out by the University in non-compliance with the Act.