Right to be forgotten

Individuals have the right to instruct the university to delete their personal data in a number of cases. This is called the ‘right to be forgotten’.

Under what circumstances can I have personal data deleted?

If someone informs you that information is objectively incorrect, incomplete or irrelevant, you can always have this data deleted. Please contact your privacy officer to arrange this.

As of May 2018, you can also have personal data deleted if:

• It is no longer needed

  The organisation no longer needs the personal data for the purposes for which the organisation collected or is processing the information.

• Permission is withdrawn

  The person concerned previously gave the organisation (explicit) permission to use his or her information, but that person has now withdrawn that permission.

• There is an objection

  The person concerned raises an objection to the processing. Article 21 of the GDPR provides for an absolute right to object to direct marketing, as well as a relative right to object if the rights of the person concerned outweigh the interest of the organisation in processing the personal data.

• Unlawful processing

  The organisation is processing the personal data unlawfully, for example because there are no legal grounds for processing the data.

• Legally-determined retention period

  The organisation is legally obliged to delete the information after a certain length of time.

• Children

  The person concerned is under 16 and the personal data was collected through an app or website (‘information society service’).