A. The GDPR and the rights of data subjects
In May 2018, the General Data Protection Regulation (GDPR), came in force in the European Economic Space.
The GDPR is the legal framework in the EU for the protection of personal data of natural persons (living individuals). Each member state has a national implementation of this framework. In the Netherlands this is called the Algemene Verordening Gegevensbescherming (AVG).
In chapter 3 of the GDPR (Art. 12 – 23) the rights of the participants (data subjects) are listed. You will have to warrant these rights. The most important are:
- To be informed how to exercise these rights.
- To be informed how the data will be processed, where and for how long.
- Right of access by the data subject.
- Right to rectification
- Right to erasure (‘right to be forgotten’)
- Right to data portability
- Right to object
In general you need to inform your participants how to contact you or the UU in order to exercise these rights. It is common to do so in the information letter accompanying the consent form.