Deleting personal data
In certain cases, people have the right to require the university to delete their personal data, for example if the university no longer needs the information or if someone withdraws their permission to use the information.
Right to be forgotten
In certain cases, people have the right to require the university to delete their personal data. We call this the ‘right to be forgotten’.
Under what circumstances can I have personal data deleted?
If someone informs you that information is objectively incorrect, incomplete or irrelevant, you can always have this data deleted. Please contact your privacy officer to arrange this.
As of May 2018, you can also have personal data deleted if:
It is no longer needed
The organisation no longer needs the personal data for the purposes for which the organisation collected or is processing the information.
Permission is withdrawn
The person concerned previously gave the organisation (explicit) permission to use his or her information, but that person has now withdrawn that permission.
There is an objection
The person concerned raises an objection to the processing. Article 21 of the GDPR provides for an absolute right to object to direct marketing, as well as a relative right to object if the rights of the person concerned outweigh the interest of the organisation in processing the personal data.
The organisation is processing the personal data unlawfully, for example because there are no legal grounds for processing the data.
Legally-determined retention period
The organisation is legally obliged to delete the information after a certain length of time.
The person concerned is under 16 and the personal data was collected through an app or website (‘information society service’).