Deleting personal data
Individuals have the right to instruct the university to delete their personal data in a number of cases. For instance, if the university no longer needs the data, or if the person withdraws consent previously given.
Right to be forgotten
Individuals have the right to instruct the university to delete their personal data in a number of cases. This is called the ‘right to be forgotten’.
Under what circumstances can I have personal data deleted?
If someone informs you that information is objectively incorrect, incomplete or irrelevant, you can always have this data deleted. Please contact your privacy officer to arrange this.
As of May 2018, you can also have personal data deleted if:
It is no longer needed
The organisation no longer needs the personal data for the purposes for which the organisation collected or is processing the information.
Permission is withdrawn
The person concerned previously gave the organisation (explicit) permission to use his or her information, but that person has now withdrawn that permission.
There is an objection
The person concerned raises an objection to the processing. Article 21 of the GDPR provides for an absolute right to object to direct marketing, as well as a relative right to object if the rights of the person concerned outweigh the interest of the organisation in processing the personal data.
The organisation is processing the personal data unlawfully, for example because there are no legal grounds for processing the data.
Legally-determined retention period
The organisation is legally obliged to delete the information after a certain length of time.
The person concerned is under 16 and the personal data was collected through an app or website (‘information society service’).