Your data rights
Under the General Data Protection Regulation (GDPR) you have the following rights:
Faq Items
Right to be informed
You have the right to be informed about the collection and use of your personal data. The University does this through its privacy notices.
Right of access
You have the right to request access to and details of the information the University holds about you. This is known as a Subject Access Request (SAR).
Right to rectification
You have the right to ask the University to correct or complete any inaccurate data.
Right to erasure
This is also known as ‘the right to be forgotten’. You have the right to ask the University to erase information it holds about you. However, this is not an absolute right and will only apply where:
- the processing of the personal data is no longer necessary for the purpose which the University originally collected it for
- The University is relying on consent and you withdraw that consent
- The data is being unlawfully processed
- The University is obliged to erase the data to comply with a legal obligation.
Right to restrict processing
You have the right to ask that the processing of your data is restricted. This right will only apply where:
- you are contesting the accuracy of the data and the University is seeking to verify it.The processing of the data is unlawful, but you want the record preserved.
- You need the data to establish, exercise and/or defend a legal claim.
- You have exercised their right to object and a decision is pending.
- This right is closely linked to the right to rectification and the right to object.
Right to data portability
This right allows you to obtain and reuse their personal data for your own purposes across different services. It allows you in certain circumstances to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way without it affecting its usability.
You have the right to be provided with a copy of your data in an accessible electronic format. At your request, the University can pass this data to another data controller.
This right applies if you gave the University the data with consent or if the data was provided as required for a contract between you and and the University and the processing is electronic.
Right to object
This right effectively allows you to ask the University to stop processing your personal data. This right only applies in certain circumstances and will depend on the University’s purpose for processing and the lawful basis.
You have the right to object to the University processing your personal data where the basis of the processing is based on the performance of a task in the public interest or in exercise of official authority.
However, this right will not apply where the University has demonstrated overriding grounds to continue processing or for the establishment, exercise and/or defence of a legal claim.
Right to object to automated decision making
If decisions are made by machine calculation of data held, this right allows you to object to having decisions made by an automated process. The machine calculation of the data is known as profiling and could mean analysing and predicting a data subject’s economic situation, health, location or movements, and preferences or behaviour.
However, this right does not apply where the processing is necessary for a contract between you and the University, the processing is authorised by law with necessary safeguards to your rights and freedoms or you have given explicit consent to the profiling.
We tell you in our privacy notices if we use automated decision making.
We refer to these as 'Rights Requests'
The Data Protection Officer (DPO) is responsible for processing all Rights Requests
If you wish to exercise any of your rights, please contact the DPO by email at: DPO@ljmu.ac.uk.
You should describe the information you want as clearly as possible. If your request is too broad or unclear, we will ask you to be more specific.
Please be aware that we cannot process your request until we have received proof of your identity.
All requests will be logged and acknowledged on behalf of the University by the DPO.
Timescales
We will dealt with your Rights Request ‘without undue delay’ and, in any event, within one month. In all cases the timescale starts from the point that we have verified your identity.
The timescale is extendable by two further months, if necessary, due to complexity/scale of the request.
A decision to extend the timescale will be made by the DPO who will inform you of any such extension within one month of receipt, together with reasons for the delay.
Fees
A Rights Request can be exercised free of charge.
However, where a Rights Request is deemed to be ‘manifestly unfounded’ or ‘excessive’ (which includes repeat requests), the University may either refuse to act on the request or charge a reasonable fee.
A decision that a Rights Request is manifestly unfounded or excessive will be made by the DPO.
The University is also allowed to charge a reasonable fee for providing copies of the data which has already been provided.
A ‘reasonable fee’ will be calculated based on the actual administrative costs of providing the information.
