Your data protection rights

One of the principles of data protection legislation is transparency and one of the data protection rights is the right to be informed. This means that the College must tell you how your data is collected, what purpose it is used for and who it is shared with.

This information will be provided in writing, normally at the point when the personal data is being collected in a document called a privacy notice.

The College will always be transparent about what we do with your data. We will try to make this information easy to understand. We will review the information in our privacy notices regularly and update it where necessary.

You can find our privacy notices on our website. If you have questions about how your data is managed you can ask a member of our staff to talk you through it.

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

If we have shared this information with anyone else, we will tell them to correct it too, and we will tell you about this if you ask us.

In some circumstances we might not be able to correct the information. This might be because we want to keep a record of the original information we received as well as the correction request as a supplementary statement. If this is the case will explain to you the reason why we unable to fulfil your request.

The College will aim to fix any incorrect personal data within a month. If it’s going to longer to correct, we will let you know within the first month, because if it’s a complicated case we can extend the period by 2 months.

You can read more about this right here.

You have the right to ask us to delete or destroy your personal information in certain circumstances. This right is sometimes referred to as the “right to be forgotten”. This is a qualified right, which means it only applies in certain circumstances:

When may the right to have your information deleted apply?

• We no longer need your personal data for the purpose for which it was originally collected or processed.
• If consent was the lawful basis for processing your personal data and that consent has been withdrawn.
• If we are relying on legitimate interests as a legal basis for processing your personal data and following your objection it has been determined that the College has no overriding legitimate grounds to keep processing your data.
• Personal data are being processed for direct marketing purposes (e.g. name and email address) and you object to that processing.
• If the law requires that personal data must be destroyed.

When does the right to have your information deleted not apply?

The right will not apply if the College needs to make use of personal data for one of the following reasons:

• to exercise the right of freedom of expression and information.
• to comply with a legal obligation e.g. tax legislation requires that certain financial records are kept for a number of years.
• for the performance of a task carried out in the public interest or in the exercise of official authority.
• for archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing.
• for the establishment, exercise or defence of legal claims.

Sometimes there are specific laws which say how long we must keep information, and sometimes how long we keep information is based on a practical reason.

This means that in some cases we won’t be able to delete or remove your information. In such cases there will be a good reason why we can’t, and we will explain this to you.

We will respond to your request within one month unless your request is complex, and we need more time. In this case we can extend the time period by 2 months. If we are not going to comply with your request we will tell you within the first month and explain why.

You can read more about this right here.

You have the right to ask us to restrict the processing of your information in certain circumstances.

The right to restrict processing means that you can limit the way that the College uses your personal data, in certain circumstances. If the right to restrict processing is available and applied, then the College can continue to retain/store personal data, however, no other use of the data can be made until such times as a restriction is lifted. In most cases a restriction will only apply for a limited period of time.

When may the right to restrict apply?

• you question the accuracy of your personal data and the College then needs to verify its accuracy.
• the data has been unlawfully processed i.e. there is no lawful basis that can be applied to validate the College’s use of that personal data, and you do not wish your data to be deleted but request that it’s use is restricted as an alternative.
• the College no longer needs the personal data, but you need the data to be retained in order to establish, exercise or defend a legal claim
• you have exercised your right to object (see below) and the College is in the process of considering whether there are legitimate grounds that would allow for the right to object to be refused.

When can a restriction be lifted?

Restrictions will normally be temporary when the accuracy of personal data are being contested, or when an objection to the use/processing of data has been made and an assessment of where the legitimate interest to further use may lay is being considered. Once decisions on either of those questions have been settled then a restriction can be lifted, however before doing so the College must inform the person concerned.

When processing is restricted, we can store your information, but we won’t be able to process it any further. If we have shared this information with anyone else, we will tell them to stop processing your information too. We will retain enough information to ensure that any restrictions that are placed on processing your information are respected. If we decide to lift a restriction on the processing of your information, we will let you know.

We have one month to respond to your request which can be extended by 2 months if it is a complex request. If we decide we can’t comply with your request, we will let you know within the first month and explain our reasons why.

You can read more about this right here.

In some circumstances, you have the right to object to the processing of your personal data. If the College agrees to an objection, it must stop using the personal data for that purpose unless it can give strong and legitimate reasons to continue to make use of the data, despite the objections that were raised.

You have an absolute right to object to the use of your personal data for the purposes of direct marketing.

When may the right to object be available?

You can only object to your personal data being used by the College, where it is use is based on:

• a task carried out in the public interest
• the College’s legitimate interests
• scientific or historical research, or statistical purposes
• direct marketing.

When raising an objection (except for direct marketing), you must give specific reasons why you are objecting to the processing of your personal data. These reasons should be based upon your particular situation.

If we are processing your information in any of these ways we will tell you in the privacy notice that we give you when we collect your information. You can also see the privacy notices on our website.

If you choose to exercise your right to object, we will stop processing your information unless we are able to:

• demonstrate that the reason we are processing your information overrides your reason for objecting; or
• the processing is being done to establish, exercise or defend a legal claim.

This may mean that we won’t be able to be able stop processing your information, even if you make a request. This is because the College is subject to laws which affect the activities we do, how we do them, and how we evidence decisions and actions we’ve taken.

We have one month to respond to your request which can be extended by 2 months if it is a complex request. If we decide we can’t comply with your request, we will let you know within the first month and explain our reasons why.

You can read more about this right here.

This right only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or as part of a contract, or at the pre-contract stage, and the processing is automated.

We will do this within one month but if your request is complex it might take a bit longer. In this case we may be allowed to extend the period of time we can respond by 2 months, but we will tell you about it and explain why.

You can read more about this right here.

Individuals have the right to object to automatic decision making and profiling. This is when a computer or programme makes an important decision about you without a human being involved in making that decision. Presently, the College does not have such processes in operation; should it do so then this will be made known in the relevant privacy notice(s).

You have the right to ask us for your personal information. This right always applies. There are some exemptions, which mean you may not always receive all the information we hold about you. If these circumstances apply, we will give you as much information as we can. Some examples of these circumstances are:

• Information which may be seriously harmful to you or someone else.
• The information identifies another person who has not agreed to it being passed to you.
• Information given and held for the purposes of preventing or detecting crime, or for prosecuting or apprehending offenders.
• Information which is restricted by another law.

You are not required to pay any charge for exercising your rights.

We have one month to respond to you. If we can’t provide you the information within one month we will let you know and explain the reason why. It might be because the request is complex, so it will take us a bit longer to respond. If it's a complicated case we can extend the period for a final response by 2 months.

You can read more about this right here.

Please contact us at dpo@slc.ac.uk if you wish to make a request.

You have the right to make a complaint to the Information Commissioner’s Office. They are responsible for making sure that organisation’s handle your information lawfully. For more information please visit their website