Rights of the data subject

The individual whose personal data are being processed, the data subjects, have a number of rights under the GDPR. The rights aim to increase the data subjects’ control over their personal data. Therefore, the data subject has the right to, in some cases, to get their personal data corrected, deleted, blocked, extracted or moved.

The rights of the data subject:

The right to information

The data subject is entitled to receive information when his or her personal data is being processed. The information about the processing shall be provided by the controller, both when the data is collected directly from the data subject or when it is collected from another source. For more information, read these guidelines.

Right of access by the data subject

The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and the following information from the controller:

  • The purpose of the processing
  • The categories of personal data concerned
  • The recipients or categories of recipients to whom the personal data have been or will be disclosed
  • Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
  • The rights of the data subject
  • The right to lodge a complaint to Datainspektionen
  • Where the personal data are not collected from the data subject, any available information as to their source
  • The existence of automated decision-making

Right to rectification

The data subject shall have the right to request to get inaccurate personal data concerning him or her corrected.

Right to erasure (’right to be forgotten’)

The data subject shall, in some cases, have the right to get personal data concerning him or her erased.

Right to restriction of processing

The data subject shall have the right to restrict the processing. The right applies among other situations if the accuracy of the personal data is contested by the data subject. In this situation the data subject can demand a restriction of the processing his during the time that the controller assess the accuracy of the personal data.

Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

This only applies to personal data given by the data subject and if the processing is based on a consent or to fulfill a contract with the data subject.

Right to object

The data subject shall have the right to object to the processing of personal data concerning him or her. The right to object applies if the processing is based on a task carried out by a public authority, in the public interest or legitimate interests.

Automated decision-making

The data subject shall have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects him or her. An automated denial of a credit or job application classifies as automated decision-making.

Complaint

The data subject is entitled to lodge a complaint to Datainspektionen if he or she considers that the processing is violating the GDPR.

Indemnity

A person who has suffered damage due to the processing of his or her personal data may be entitled to indemnity by the controller.

If you receive a request from a data subject who wishes to exercise his or her rights

If you receive a request from a data subject who wishes to exercise his or her rights as a data subject, please send it to the Legal Department at KI.

Contact details of the Legal Department: registrator@ki.se