The rights of data subjects

The first right, and perhaps the most important one, is the right to access. The data subject has a right to find out if SLU is processing their personal data, access the data and have the following information:

1. The purpose of the processing (according to the register managed by the data protection officer).
   
   
2. The categories of personal data processed.
   
   
3. Any third parties that have or may be granted access to the personal data.
   
   
4. For how long SLU is planning to store the data, or the criteria that will determine how long it will be stored.
   
   
5. What rights the data subject has when it comes to processing. These rights are described in more detail below.
   
   
6. The right to file a complaint with the Swedish Authority for Privacy Protection.
   
   
7. What sources the personal data has been collected from, if it was not collected from the data subjects themselves.

The data subject also has the right to a free copy of the personal data, in an accessible format. If someone requests additional copies, we can charge a fee for this.

The data subject has the right to request that their personal data be corrected without undue delay. If necessary, the data subject also has the right to supply additional personal data.

Another central right is the right to be erased. The data subject has the right to have their data deleted from SLU's registry without undue delay. This right can be exercised under the following circumstances:

1. The data is no longer needed for the purpose of the processing. This can be the case e.g. if an employee has left SLU.
   
   
2. The legal basis for the processing is consent, and the data subject withdraws their consent. If there is no other legal basis for the processing, the data should be deleted.
   
   
3. The data subject objects to processing carried out as part of the exercise of public authority or in the public interest. Unless SLU has very good reasons for continuing the processing, the data should be deleted.
   
   
4. If personal data is processed to be used in direct marketing, the data should be deleted immediately if the data subject requests it.
   
   
5. If the personal data has been processed in an unlawful way.
   
   
6. If there is a legal requirement to delete the data.

If SLU has made public personal data that we are required to delete, we must take all reasonable measures to inform other parties processing the data that the data subject has requested that they be deleted. Any third parties must also be informed that they should delete al links, copies or replications of the data concerned.

Exceptions

The above does not apply if the processing of personal data is necessary for one of the following reasons:

1. Exercising the right of freedom of expression and information.
   
   
2. Carrying out a legal obligation according to EU or Swedish legislation.
3. Carrying out a task in the public interest.
   
   
4. Carrying out a task that is part of the exercise of public authority.
   
   
5. For reasons in the public interest in the area of public health.
   
   
6. For archiving purposes in the public interest, or for scientific, historical or statistical purposes, if deleting the data would make the archiving impossible or significantly more difficult.
   
   
7. To exercise the legal claims of SLU, a student or an employee.

Limitation of personal data is a right that sounds somewhat abstract, but simply put means ensuring that data only is stored and not processed in any other way.

Provided the data subject consents, the data may be processed anyway – if it is necessary to exercise a legal claim, or on important grounds of public interest for Sweden or the EU.

A data subject has the right to request that the processing of their data be limited if one of the following applies:

1. The data subject believes that the data is incorrect, and SLU needs time to verify this.
   
   
2. The processing is unlawful, but the data subject requests limitation rather than erasure.
   
   
3. SLU no longer requires the data, but the data subject needs it to exercise a legal claim.
   
   
4. The data subject has objected to the processing. Until it has been determined whether SLU's reasons for processing outweigh the data subject's reasons for limiting processing, the processing should be limited.

If processing is limited in accordance with paragraph 1 above, SLU must inform the data subject before the processing is terminated.

If the data subject has provided SLU with their personal data, they have the right to a copy of it in a commonly used and machine-readable format.

This right will rarely be relevant to SLU operations. If a data subject wishes to exercise this right, contact dataskydd@slu.se.

The data subject has the right, at any time, to object to the processing of their personal data if the processing is done in the public interest or is part of the exercise of public authority. The processing must then be terminated, unless SLU can prove that there are reasons for continuing the processing that outweigh the data subject's interests, rights and freedoms. SLU may also continue the processing if it is necessary to exercise a legal claim.

If the processing is done for scientific, historical or statistical purposes, it may continue if it is necessary to carry out a task in the public interest.

The data subject must be informed about this right in a clear manner, separate from other information. This must be done the first time SLU communicates with the data subject, at the latest. If appropriate, we can give this information at an earlier point in time.