Article 15 of the General Data Protection Regulation (GDPR) regulates the right of access of the data subject to the processing of personal data.

Accordingly, the data subject has the right to "obtain from the controller [here: the Bureau] confirmation as to whether personal data relating to him or her are being processed; if this is the case, he or she shall have the right of access to those personal data and to the following information:

• the purposes of processing;
• the categories of personal data processed; and
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations;
• if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
• the existence of a right to obtain the rectification or erasure of personal data concerning him or her, or the restriction of processing by the controller, or a right to object to such processing;
• the existence of a right of appeal to a supervisory authority;
• if the personal data are not collected from the data subject, any available information on the origin of the data;
• the existence of automated decision-making, including profiling.

The University strives to create the greatest possible transparency with regard to the processing of personal data of its members and affiliates. One measure that has already been implemented is the option for every user to request automated "data protection information" about their personal data processed in Stud.IP. You can find the corresponding link in your profile on the left-hand side under "Actions". Further measures are planned and will follow.

If you would like to make use of your right to information according to Art. 15 GDPR, please send an e-mail to , stating information that sufficiently identifies you and, if necessary, specifying your request for information, or use our contact form.

Article 16 of the General Data Protection Regulation (GDPR) regulates the right to rectification of the person concerned by the processing of personal data.

The data subject has the right "to obtain from the controller the rectification without delay of inaccurate personal data concerning him or her". Taking into account the purposes of the processing, the data subject shall have the right to obtain the completion of any incomplete personal data, including by means of a supplementary declaration."

Should you wish to make use of your right to rectification in accordance with Art. 16 of the GDPR, please send an e-mail to the Data Protection Officer at the following e-mail address: , stating information that sufficiently identifies you and, if applicable, specifying your request for information.

Article 17 of the General Data Protection Regulation (GDPR) provides for the right to erasure or the "right to be forgotten" of the data subject from the processing of personal data.

The data subject has the right "to obtain from the controller the erasure without delay of personal data concerning him or her, and the controller is obliged to erase personal data without delay where one of the following reasons applies:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• The data subject withdraws the consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2).
• object to the processing.
• The personal data have been processed unlawfully.
• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to information society services offered in accordance with Article 8(1)."

Should you wish to exercise your right to erasure pursuant to Article 17 of the GDPR, please send an e-mail to the Data Protection Officer at the following e-mail address: providing information that sufficiently identifies you and, if applicable, specifying your request for information.

Article 18 of the General Data Protection Regulation (GDPR) provides for the right of the data subject to restrict the processing of personal data.

According to this provision, the data subject has the right "to obtain from the controller the restriction of processing where one of the following conditions is met:

• the accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of the use of the personal data;
• the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defence of legal claims; or
• the data subject has objected to the processing pursuant to Article 21(1), as long as it is not yet established whether the legitimate grounds of the controller override those of the data subject."

Where processing has been restricted, personal data may be processed, apart from being stored, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person or for reasons of substantial public interest of the Union or of a Member State. The data subject shall be informed by the controller before the restriction is lifted.

Should you wish to exercise your right to restriction of processing under Article 18 of the GDPR, please send an e-mail to the Data Protection Officer at the following e-mail address: providing information that sufficiently identifies you and, if applicable, specifying your request for information.

The General Data Protection Regulation (GDPR) regulates in Article 19 the obligation to cooperate in connection with the rectification or erasure or the restriction of processing of the data subject.

Accordingly, the controller shall "notify all recipients to whom personal data have been disclosed of any rectification or erasure of the personal data or restriction of processing pursuant to Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort".

The data subject has the right vis-à-vis the controller to be informed about the recipients.

If you have any questions regarding the obligation to cooperate in accordance with Article 19 of the GDPR, please send an e-mail to the Data Protection Officer at stating sufficiently identifiable information and, if necessary, specifying your request for information.

Article 20 of the General Data Protection Regulation (GDPR) regulates the right to data portability of the data subject of the processing of personal data.

According to this provision, the data subject has the right "to receive personal data concerning him or her which he or she has provided to a controller in a structured, commonly used and machine-readable format, and to have that data transferred to another controller without hindrance from the controller to whom the personal data were provided, provided that

• the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b); and
• the processing is carried out by automated means."

When exercising his or her right to data portability, the data subject also has the right to "obtain that the personal data be transferred directly from one controller to another controller where technically feasible."

This right does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Should you wish to exercise your right to data portability under Article 20 of the GDPR, please send an e-mail to the Data Protection Officer at the following e-mail address: providing information that sufficiently identifies you and, if applicable, specifying your request for information.

Article 21 of the General Data Protection Regulation (GDPR) provides for the right of the data subject to object to the processing of personal data.

According to this provision, the data subject has the right "to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is carried out on the basis of Article 6(1)(e) or (f ); this shall also apply to any profiling based on those provisions". The controller shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims."

The data subject shall further have the right to object "on grounds relating to his or her particular situation, to processing of personal data concerning him or her which is carried out for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1), unless the processing is necessary for the performance of a task carried out in the public interest."

Direct marketing

If personal data are processed for the purposes of direct marketing, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If the data subject objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

Should you wish to exercise your right to object pursuant to Art. 21 GDPR, please send an e-mail to the data protection officer at the e-mail: dsuni@uol.de, stating information that sufficiently identifies you and, if applicable, specifying your request for information

Article 22 of the General Data Protection Regulation (GDPR) regulates the right of the data subject to the processing of personal data to object to an automated decision in an individual case, including profiling.

Accordingly, the data subject has the right "not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her".

Exceptions

This does not apply if the decision

• is necessary for the conclusion or performance of a contract between the data subject and the controller,
• is permitted by Union or Member State law to which the controller is subject and that law contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject; or
• is carried out with the express consent of the data subject.

Safeguarding rights

In order to safeguard the rights of the data subject concerned by the processing of personal data, he or she may

• obtain the intervention of a person on the part of the controller
• state his or her own position
• challenge the decision

If you wish to object to an automated decision in an individual case pursuant to Article 22 of the GDPR, please send an e-mail to the Data Protection Officer at the e-mail: , stating information that sufficiently identifies you and, if applicable, specifying your request for information.

The General Data Protection Regulation (GDPR) regulates in Article 7(3) the right of withdrawal in relation to the consent of the data subject to the processing of personal data.

The data subject has the right to "withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal. The data subject shall be informed of this before giving consent. The withdrawal of consent shall be as simple as giving consent."

Scope

Art. 7(3) GDPR applies if the processing is based on consent and therefore the legal basis for the processing is Art. 6(1)(a) or Art. 9(2)(a) GDPR.

If you wish to exercise your right of revocation pursuant to Art. 7 (3) of the GDPR, please send an e-mail to , stating information that sufficiently identifies you and, if applicable, specifying your request for information.

Article 77 of the General Data Protection Regulation (GDPR) regulates the right of the data subject to lodge a complaint concerning the processing of personal data.

According to this Article, "without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or the place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation".

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

Before filing a complaint with the supervisory authority, we recommend that you contact the data protection officer of the data controller, who is not bound by instructions in his or her function and who will work towards a prompt solution in many data protection-related problem situations.

The supervisory authority responsible for the Carl von Ossietzky University Oldenburg is:

The State Commissioner for Data Protection of Lower Saxony Prinzenstraße 5 30159 Hanover

Telephone: 0511 120-4500 Fax: 0511 120-4599 Email: