Rights of the "Data Subject"

According to GDPR (articles 12-23), every data subject has specific rights concerning their personal data. Every entity processing personal data is legally obliged to accommodate these inquiries by the data subject within a short amount of time:

• Right to revoke consent
• Right to information
• Right to correction
• Right to deletion
• Right to data portability
• Right to file a complaint with the supervisory authority

Please always contact privacy@mpi.nl if a data subject expresses the wish to act upon the rights described above. 

Some of the above described rights require the data subject to take action, but the right to information is actually a right in which we proactively have to provide information to the data subject. The following information always has to be provided when processing personal data:

• Identity and contact details of the controller and the data protection officer
• Purpose of the processing
• Legal basis of the processing
• Recipients
• Storage period, or the criteria used to determine that period
• Details of intended transfers into third countries (outside EU/EEA)
• Comments on all other rights of the data subject
• When collecting data from third parties: source of data

Examples:

• Study information sheets and informed consent procedures (see links for examples, but please also check within your own group)
• All online registration procedures (signing up for studies, newsletters, event registrations, making an account on platforms, etc.)
• Website information (privacy policy)
• Video surveillance information
• Guest contracts
• Job applications
• Etc.

Please ask privacy@mpi.nl for the most recent templates.