## Your rights

Reading time
10 minutes

What you will learn
You will learn what rights you have when it comes to the protection of your own privacy and that of others.

Summary
It is laid down by law how others, such as an education institution, are required to deal with your privacy and personal data, such as which information they may request, with whom they may share it, etc. However, as with all laws, there are exceptions, rules are dependent upon particular situations and education institutions are partly free to determine their own rules. So it's a good idea to know what rights you have when it comes to privacy at your specific education institution.

####

## Your rights

Everyone has a right to privacy. That right is quite comprehensive; in nearly every situation, you decide what can be done with your personal data. Watch the video clip below, which shows you exactly on what principles the privacy law is based:

So, are you simply allowed to inspect all information about yourself? Which of your personal information does the education institution actually share and why? You will receive the answers to these questions here.

Consider for a moment: what do you actually already know about the privacy law?

## Legal basis

There was something about legal bases – remember? Each time someone processes your personal data, that can constitute an infringement on your privacy. Processing personal data is therefore only permitted if a basis exists for doing so. For example, your education institution cannot provide education without having some personal data at its disposal (name, email address, home address, etc.).

There are six legal bases (reasons) on which an individual or organisation is allowed to process personal data. One of these is if you yourself have consented to this. Another is a public task; this is the basis that applies to your education institution, for instance. Public education institutions are established by the government for the purpose of providing education; if you enrol in such an institution, it is permitted to request some personal data from you in order to perform its task properly.

The education institution is in turn allowed to share certain data with other parties. This can include sharing your email address with the Education Executive Agency (DUO) so that it will be able to contact you about your student grant, or your study progress with an education institution abroad if you will be doing part of your study programme there. Your education institution must clearly state which of your data it stores, for what purpose it requests that data and with whom it will share the data.

Consider for a moment: do you remember what was stated in the enrolment form for your education institution about sharing data when you enrolled there?

## Data minimisation

One of the key principles of the privacy law is ‘data minimisation’. This means that an organisation, such as an education institution, is only allowed to request the information that is strictly necessary in order to fulfil a particular purpose. For example:

- is it relevant for an education institution to know the colour of your skin? Answer: no

- is it relevant for an education institution to know how much salary you make? Answer: no

- is it relevant for an education institution to know your address? Answer: yes

So anytime someone asks for your personal information, it is a good idea to think critically about this. Do they actually need this particular information about you? Or could they fulfil their purpose with less information? Have a look at this example:

[space for inserting an example about data minimisation that is relevant for the education institution itself]

Consider for a moment: can you come up with your own example of a situation in which you gave away more personal information than might have been necessary in retrospect?

## Sharing

By law, you yourself determine from the age of 16 who has access to your personal information. The same goes for the information that an education institution stores about you. Therefore, an education institution is never permitted to simply share information about you, except in certain cases:

- If you give your consent for this, for instance if you are taking part in research at the education institution.

- If the education institution is under a legal obligation to do so, for instance to share information about your graduation with the Education Executive Agency (DUO) or with StudieLink.

In this way, you can be sure than no one can ever simply walk up to the front desk of your education institution and inspect your data, or that the education institution can sell your data to businesses for marketing purposes.

Consider for a moment: which of the information about you which is known to your education institution, would you definitely not want to share with others?

## Photos and video clips

Every day, we take huge quantities of photos and shoot gigantic numbers of video clips, including at the education institution. But what exactly are the rules for this? Are you allowed, for example, to simply film your lecturer in a lecture hall? Or your fellow students? It is a good idea to know exactly what the rules are for this:

[space to state regulations/rights of students that are specific to the education institution]

Consider for a moment: what do you think about the rules with respect to photos and video clips that apply at our education institution?

## Your data

Your data is yours. The education institution only uses it to make sure you can receive a good education. If you want to inspect the data the education institution has about you, then you may request to do so. You can do this via:

[space to state the regulations with respect to requests to inspect personal data that are specific to the education institution]

All information concerning the handling of information at our education institution is laid down in the ‘Information protection policy’. You can download and examine this document via the button below:

'Information protection policy