• 1

Rights of the interested parties

The protection of personal data is a fundamental right of all individuals guaranteed by article 18.4 of the Spanish Constitution and that recognizes the power of disposal and control of people over their data.

Regulation (EU) 2016/679, General Data Protection (RGPD) and Organic Law 3/2018, on Data Protection and guarantee of digital rights (LOPDgdd) recognize holders of the right to the protection of data, a series of faculties: the rights of access, rectification, deletion, portability, limitation, opposition and not to be subject to decisions based solely on the automated processing of your data.

These rights are of a very personal nature, that is, they are exercised by their owner or representative, they are exercised free of charge, and the URJC has several channels for their exercise.

Right of access:

It is the right to contact the person in charge to find out whether or not they are treating personal data that concerns them and, in the event that such treatment is being carried out, to obtain:

  • copy of the data object of the treatment
  • information on the purposes of the treatment, the categories of data that are processed, the recipients or categories of recipients to whom the data is communicated or will be communicated.
  • information on retention periods (or, if this is not possible, the criteria used to determine them).
  • information available on the origin of the data when these have not been obtained from the interested party.
  • information about the existence of automated decisions, including profiling.
  • Information, in the event that the data is transferred to a third country or an international organization, on the guarantees of the transfer.
  • Information on the existence of the rights of rectification, deletion, limitation and opposition to the treatment and on the right to file a claim with a control authority.

Right of rectification:

It is the right to obtain, without undue delay, the rectification of personal data that is inaccurate, or to complete those that are incomplete, taking into account the purposes for which they are processed.

The request to exercise this right must indicate the inaccurate data and the correction that must be made, for which it may be necessary to accompany it with documentation that justifies these extremes.

Right of suppression (or “to be forgotten”):

It is the right of people to contact the data controller to obtain the deletion of their personal data in the following cases:

  • when they are no longer necessary in relation to the purposes of the treatment,
  • when consent is withdrawn, provided that there is no other legitimate cause for processing,
  • when the right to oppose the treatment has been exercised and there are no legitimate reasons to continue with it, provided that the requirements of this right are met
  • when the data has been illicitly processed,
  • when they must be deleted in compliance with a legal obligation,
  • when they have been obtained in relation to an offer of information society services to minors.

However, this right is not unlimited, in such a way that there may be cases in which the deletion cannot be carried out when the treatment is necessary for the exercise of freedom of expression and information, for the fulfillment of a legal obligation, for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the responsible person, for reasons of public interest, in the field of public health, for archiving purposes of public interest, scientific research purposes or historical or statistical purposes, or for the formulation, exercise or defense of claims.

Right of opposition:

It is the right to object at any time to the processing of personal data, in any of the following cases:

  • When the processing of the data is the consequence of a mission carried out in the public interest or in the exercise of public powers conferred on the controller. In this case, the person in charge will stop processing the data unless it proves compelling reasons that prevail over the interests, rights and freedoms of the interested party, or for the formulation, exercise or defense of claims.
  • When the purpose of the treatment is direct marketing. In that case, the person in charge will stop processing the data for those purposes.

Right to limitation of treatment:

It is the right to obtain from the person in charge the limitation of the treatment carried out by the person in charge, being able to:

Request the suspension of data processing

  • for the time necessary to verify the accuracy of the data when the interested party has challenged it,
  • while it is verified if the legitimate reasons of the person in charge prevail to process the data based on the legitimate interest or mission of general interest, when the interested party has exercised the right of opposition.

Request data retention:

  • when the treatment is illegal and the interested party opposes the deletion of the data
  • when the data is not necessary for the purposes of the treatment, but the interested party needs it for the formulation, exercise or defense of claims

Portability right:

The purpose of this right is to reinforce the control of personal data, so that when the treatment is carried out by automated means, the interested party can receive their personal data in a structured, commonly used, machine-readable and interoperable format, and can transmit them to another controller, provided that the treatment is legitimized based on consent or within the framework of the execution of a contract.

However, this right, by its very nature, cannot be applied when the treatment is necessary for the fulfillment of a mission of public interest or in the exercise of public powers conferred on the person in charge.

Right not to be subject to automated decisions, including profiling:

The purpose of this right is to guarantee that people are not the subject of a decision based solely on automated processing, including profiling, that produces legal effects on the interested party or significantly affects them in a similar way.