General Data Protection Regulation (GDPR) - teach and supervise

The person whose data is being processed has a number of rights that are important to consider. These are, as mentioned, the right to receive information about what the data will be used for (purpose of the processing), what information is collected, how long the data will be saved (or what determines how long) and the right to access the data that is registered about their own person. Furthermore, the data subject also has the right to object to the treatment, have incorrect information corrected, and revoke consent (without giving any reason). The data subject also has the right to complain to Datainspektionen if he or she considers the processing to be incorrect.

The right to delete data or restrict processing is not an absolute right and there may be reasons to not comply with such a request. There may be a stronger reason for retaining the data (for example, if, in accordance with Arkivlagen (the Archive Act) or Offentlighets- och sekretesslagen (the law that governs access to public documents) or other laws, it is required to preserve the material. For example, an employee may request that his or her data be deleted from the salary specification we submit to the Tax Authorities, but we will not comply because we have a legal obligation to convey the data. In cases of uncertainty about what to delete and what to keep, the Data Protection Officer should be contacted. In general, the processing of personal data should be transparent and clear to the data subject and, if possible, we should respect the wishes of the data subject.

Through the General Data Protection Regulation, the data subject has the right to receive information about the processing, the right to know what information is being processed and extract information about his/her own person, the right to have incorrect information corrected, and the right to delete personal information (if there is no other legal basis for continued processing). For those who conduct research, it is important to know that there are two limitations on these rights:

• The right to have personal data corrected shall not apply to personal data processed for research purposes if they are kept for filing purposes only. Apart from this, the right to rectification shall apply without exception.
• The right to limit processing shall not apply when the registrant contests the accuracy of the data during the investigation period required to check whether the personal data are accurate, if this results in the research not being able to be performed or is decisively delayed or complicated. The same shall apply when the data subject objects to the processing, pending an investigation to determine whose interest is more important.