Rights of the data subject
The General Data Protection Regulation of the EU gives various rights to the person (data subject) whose personal data are processed. The rights apply differently depending on the basis on which the personal data are processed.
As a data subject, you have the right to know whether your personal data are being processed and what personal data are being processed, to request information about yourself, and to request that inaccurate personal data are corrected. You also have the right to withdraw the consent you have given if the processing of personal data is based on consent.
You have the right to know if your personal data are being processed and what data have been stored about you. The University will submit the requested information as soon as possible without undue delay. The deadline for disclosing the information or additional information related to the request is one month from receiving the request. If the information request is exceptionally complex and wide-ranging, the deadline may be extended by two months.
The information is generally provided free of charge. However, if more than one copy is requested, the University may charge a reasonable fee based on administrative costs. If the information request is clearly without a basis and unreasonable or information requests are submitted repeatedly, the University may collect the administrative costs caused by the delivery of the information or entirely refuse to deliver the information. In such a case, the University will demonstrate that the request is unfounded or unreasonable.
The response to the information request can be subject to a charge for the requester: Charges for document requests.
If the University does not deliver the information, a written statement on the matter will be provided. In connection with this, the requester will be informed of their right to legal remedies, for example, of their right to submit a complaint to the supervisory authority.
The right applies to all bases for processing personal data.
You have the right to demand that any erroneous, inaccurate or deficient personal data is corrected or supplemented without undue delay. In addition, you have the right to demand the removal of any unnecessary personal data. Redundancy and inaccuracy are assessed according to the time the data were recorded.
If the University does not approve the rectification request, a written statement is provided on the matter specifying the reasons due to which the request was not approved. In connection with this, the requester will be informed of their right to legal remedies, for example, of their right to submit a complaint to the supervisory authority.
The deadline for rectification is one month from the date the request was received. If the request is exceptionally complex and wide-ranging, the deadline may be extended by two months.
The right applies to all bases for processing personal data.
You have the right to have your personal data completely erased from the University's registers only in certain exceptional cases (right to erasure):
- your personal data are not necessary for the purposes for which they were collected or for which they were processed
- you withdraw the consent on which the processing was based and there is no other lawful basis for the processing
- you object to the processing and there is no justifiable ground for the processing
- your personal data has been unlawfully processed
- your personal data must be erased in order to comply with a legal obligation under the EU or member state legislation which is applied to the controller.
The storage and removal of data are conducted in accordance with the University’s retention schedule and statutory data storage periods.
You do not have this right, however, in such cases where the processing of personal data is necessary due to a legal obligation, the completion of a task related to the public interest or the exercise of the official authority vested in the University of Turku.
In certain situations, you have the right to ask for a restriction of the processing of your personal data until your data has been appropriately checked and corrected or supplemented:
- you contest the accuracy of your personal data, in which case processing will be restricted until the University verifies the accuracy of the data
- the processing is unlawful and you object to the erasure of your personal data and request the restriction of their use
- the University does not need your personal data for processing purposes, but you need it to establish, exercise or defend a legal claim
- you object to the processing of your personal data pending the verification of whether the University's legitimate basis for processing overrides your rights.
The right applies to all bases for processing personal data.
You have the right to receive the personal data you provide to the University in a structured, commonly-used and machine-readable format, and the right to transfer such data to another controller without the University's hindrance, if the legal basis for the processing is consent or a contract, and the processing is carried out automatically.
When you exercise your right to transfer personal data from one system to another, you have the right to have the data transferred directly from one controller to another, if technically feasible.
The right applies only if the processing is based on consent or an agreement and the personal data are provided by the data subject.
You have the right to object to the processing of your personal data at any time on the basis of a personal, specific situation. In these cases, your data may only be further processed if the University can demonstrate that there is a substantial and legitimate basis for the processing, which overrides your interests, rights and freedoms, and if it is necessary for the establishment, exercise or defence of legal claims.
The right applies only if the processing is based on a task carried out in the public interest, on public authority or on the legitimate interests of the controller.
You have the right to submit a complaint to the supervisory authority if you feel that the processing of your personal data violates the EU General Data Protection Regulation (EU) 2016/679.
Supervisory authority
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PL 800, 00531 Helsinki, Finland
Switchboard: +358 29 56 66700
In addition, you also have the right to exercise other administrative appeal methods and legal remedies.
You also have the right to bring an action against the controller or organisation processing the personal data if you feel that your rights have been violated due to the fact that the processing of the personal data has not been done in accordance with the General Data Protection Regulation.
You can find the rectification and information request form and instructions on how to fill it in the link below (form in Finnish):