GDPR Individual's Rights
GDPR includes the following rights for individuals:
- The Right to be Informed
- The Right of Access
- The Right to Rectification
- The Right to Erasure
- The Right to Restrict Processing
- The Right to Data Portability
The Right to be Informed
One of the key features of GDPR is to be transparent with data subjects about the information collected and the processing of the data. It would be advisable to include in information to parents/students and in privacy notices that schools do transfer personal data to the library system. What data transferred is up to the school. To allow the full function of the library system we recommend a minimum of the following be transferred:
- Forename
- Surname
- Gender
- Date of Birth
- Tutor Group
- Year Group
- Management System ID
Date of birth is key to restricting age appropriate resources on issue thus is a mandatory field when transferring via CSV file or our automated system. There is optional data which can be transferred such as photographs, address details, telephone numbers/email addresses, ethnicity and guardian information.
The Right of Access
Data controllers may get subject access requests from parents/students. Information regarding the data subject must be provided within one month of the written receipt of the request. The library system allows data controllers the ability to print borrower information to PDF or export it to a CSV file.
The Right to Rectification
If the information stored in the library system is incorrect then the data subject has the right for this to be corrected. It is the responsibility for the data controller to keep the library system accurate and up to date. We have provided a feature within the library system to update borrower records to correct data. For customers using our automated system, once the information has been corrected in the management information system this will automatically be transferred to the library system the following day.
The Right to Erasure
As the education of a child is in the public interest the ICO states that a school can refuse a request for erasure for the performance of a public interest task. click here for more information.
The Right to Restrict Processing
An individual who wants to exercise this right has to put their objection in writing to you and state what they require you to do to avoid causing damage or distress. We refer to this notice as an “objection to processing” although it is also known as a “section 10 notice” in practice. For more information on this please click here. In the library system a borrower can be banned or placed into the recycle bin to restrict the processing of their data.
The Right to Data Portability
This allows individuals to obtain and reuse their personal data for their own purposes across different services. All the data from the library system can be exported to a CSV file (borrower data, loans etc.) The school is able to create a view within the table for the fields they desire then export to CSV file to meet the needs of a data subject.