Data Protection Officer

Data Protection Rights

The General Data Protection Regulation recognizes the rights of access, rectification, erasure, portability, restriction of processing, and objection to processing. The ULL guarantees the exercise of these rights through a electronic procedure. The data controller must respond within one month (extendable by two months in complex cases, with notification of the extension to the applicant). 

If the interested party wishes, they can consult beforehand the Record of Processing Activities where they refer to all the activities carried out by the University and specify, where applicable, the treatment to which they refer.

▪ Right of Access:

Regulation: Article 15 GDPR y 13 LOPDGDD.

You have the right to:

    • A copy of the personal data being processed, without these having to be in a format that allows the reproduction of the service to which they are intended, which would be the right to data portability.
  • Information about:
      • the purposes of the processing carried out with said data (grouped by data categories);
      • their communications and transfers, including whether or not international transfers are made;
      • its storage period;
      • the rights you have in relation to the treatments (listed here);
    • If automated decisions exist (including profiling and/or the use of profiles), the criteria applied to those decisions (logic), and the consequences of the processing.

▪ Right of rectification:

Regulation: Article 16 GDPR y 14 LOPDGDD.

In addition to rectifying inaccurate data, you have the right to have partial personal data completed, including by means of an additional statement.

▪ Right to erasure:

Regulation: Article 17 GDPR y 15 LOPDGDD.

This right It is referred to by the GDPR itself as the “right to be forgotten”, although the Data Protection and Guarantee of Digital Rights Act distinguishes the obligation to delete the information at the source (deletion) from the deletion of information on social networks and search engines, which is what it refers to as the right to be forgotten (art. 93The right to erasure allows you to request:

    • The erasure of personal data without undue delay when any of the contemplated circumstances occur, for example, unlawful processing of data or when the purpose that motivated the processing or collection has disappeared.
  • A series of exceptions are regulated in which this right will not apply, for example, when the right to freedom of expression and information must prevail.

▪ Right to restriction of processing:

Regulation: Article 18 GDPR y 16 LOPDGDD.

This right allows:

    • Request the data controller to suspend data processing when:
        • The accuracy of the data is challenged while the responsible party verifies said accuracy.
      • The interested party has exercised their right to object to the processing of data, while it is being verified whether the legitimate grounds of the controller prevail over those of the interested party.
  • Request the data controller to retain personal data when:
      • The processing of data is unlawful and the interested party opposes the deletion of their data and requests instead the limitation of its use.
    • The controller no longer needs the data for the purposes of the processing, but the data subject does need them for the establishment, exercise or defense of legal claims.

▪ Right to data portability:

Regulation: Article 20 GDPR y 17 LOPDGDD.