General Data Protection Regulation (GDPR)
|1||Personal data controller|
Študentski dom Ljubljana
|2||Contacts of the data protection email@example.com|
|3||Purpose of the personal data processing||Due to operations and transmission of data to competent institutions and state bodies.|
|4||Legal basis to process personal data||Accommodation contract, statement, Residence Registration Act.|
|5||Types of personal data concerned|| |
|6||Users or user categories of personal data||Ljubljana Administrative Unit, Ministry responsible for higher education, AJPES, Police.|
|7||Period of retention of personal data||5 years after moving out.|
|8||Information on the existence of individual rights|
An individual has all the rights to which he is entitled under the legislation in the field of personal data protection:
Pravice v odnosu do avtomatske obdelave podatkov, pri čemer pa ta pravica posameznika ne sme biti v nasprotju z določili druge zakonodaje.
|9||Information on the right to withdraw consent||Consent may be revoked at any time without prejudice to the lawfulness of the processing of data carried out on the basis of the consent up to its revocation.|
|10||Information on the right to lodge a complaint with the supervisory authority|
|11||Information on the source of personal data||Personal data are obtained from eVŠ, records of applicants for subsidized student stays, which are kept in accordance with Article 81g of the Higher Education Act.|
The right to erasure or the right to be forgotten gives each individual the opportunity to request the controller to delete all personal data relating to him/her without undue delay. This is one of the rights guaranteed to the individual by the General Regulation on Personal Data Protection (hereinafter: GDPR) and is defined in more detail in Article 17 of the GDPR.
It should be emphasised that the right to erasure can in no way be considered an absolute right of the individual, as the GDPR specifies in which cases the controller is obliged to actually erase such data. It is obliged to do so in the following cases:
- when personal data is no longer needed for the purposes for which they were collected;
- the data subject revokes the consent and there is no other legal basis for the processing (e.g. law or contract);
- the data subject objects to the processing of such data, unless the data controller demonstrates that his/her interests in the processing of such data outweigh the interests of the individual;
- the individual whose personal data is processed for the purposes of direct marketing objects to the processing of his/her personal data for those purposes;
- personal data has been processed illegally;
- personal data must be deleted in order to fulfil a legal obligation;
- when personal data has been collected in connection with the provision of information society services regarding the consent of the child to such services.
If one of the listed cases is fulfilled, the controller is obliged to delete personal data at the request of the individual (this also applies to all publications of this data on websites, social networks, media, etc.). All of the above applies, of course, provided that the existing technology allows the deletion of personal data at all.
As already mentioned, the right for erasure is not absolute, which means that there are exceptions when an individual cannot request the erasure of personal data, namely when:
- the right to freedom of expression and information is exercised through publication;
- the processing is necessary to fulfil a legal obligation applicable to the controller;
- the processing is necessary for reasons of public policy in the field of public health;
- the processing is necessary for scientific, research, statistical, or archiving purposes, and the exercise of the right of erasure would seriously impede the exercise of those purposes;
- the data is processed for the purposes to assert, enforce, or defend legal claims (e.g. in the event of a lawsuit).