What decisions can you make about your information?
From 25 May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights.
Your rights are as follows:
- Rectification: if information the School holds about you is incorrect you can ask us to correct it.
- Access: you can also ask what information we hold about you and be provided with a copy. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
- Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
- Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your information is consent or contract (please see “Our legal bases for using your information” above); and (c) the information is being processed by us on computer.
- Restriction: our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.
- Object: you may object to us using your information where:
- a. we are using it for direct marketing purposes (e.g. to send you copies of school publications;
- b. the legal basis on which we are relying is either legitimate interests or performance of a task carried out in the public interest. Please see the section “Our legal bases for using your information” above; and
- c. we are using it for historical or scientific research purposes or archiving purposes. For example, we may keep photographs of you at a School event for historical reasons.
The Bursar can give you more information about your data protection rights.