Eco‑responsible  images

Image compression reduces page weight and loading times.

Read more about it

Search in

Individual rights

Table of contents

Rights at the heart of data protection
Individual rights


 

Rights at the heart of data protection

Data protection is essential to protect privacy and personality. The people whose personal data you hold - the individuals concerned - have the right to know what data is collected about them, who collects the data, for what purpose and with whom it is shared.

The individual may give their consent, withdraw it and request access to, rectification or deletion of their data.

These rights are intended to give you control over your personal data in an ever-changing digital world.

Individual rights

Accessing one's data

The right of access is a right that allows any person to ask the data controller whether personal data relating to them is being processed, and to have it erased or rectified if necessary. The purpose of this right is to ensure transparency and control of personal data by the individuals concerned. However, each individual must take action themselves to exercise this right.

The right of access to personal data is a right that must be respected.

The right of access is not absolute and may be refused, restricted or deferred if overriding private or public interests oppose it. The data controller must then give reasons for his decision and communicate them to the person concerned.

Any person wishing to have access to the data may do so at any time.

Any person wishing to exercise their right of access must prove their identity.

To assert your rights, contact UNIL's DPO. 

The law

The right to access one's own data (Art. 25 ff. LPrD)

  1. Any person has, at all times, free access to data concerning him or her.
  2. They may also request confirmation from the data controller that no data concerning them has been collected.
  3. The person asserting his/her right must prove his/her identity.
  4. No one may waive the right of access in advance.
Objecting to data processing Data subjects have the right to object to the processing of all or part of their personal data. In this way, they can protect their interests, depending on the situation. The data controller must respect the objection, unless it has legitimate grounds for continuing to process the data for certain purposes. The law Right to object (Art. 28 DPA) Any person has the right to object to personal data concerning them being communicated, if they can demonstrate an interest worthy of protection. The data controller will reject or withdraw the objection : if disclosure is expressly provided for by law ; if disclosure is essential for the performance of the recipient's public duties and overrides the interests of the data subject. Rectifying data The right to rectification allows the data controller to demand that incorrect data be deleted or corrected. The law Other rights (Art. 29 LPrD) Individuals who have an interest worthy of protection may require the data controller to : refrain from unlawful data processing ; eliminate the effects of unlawful data processing; or establish that data processing is unlawful; or remedy the consequences of unlawful data processing. Where appropriate, they may ask the data controller to : rectify, destroy or render anonymous the data ; publish or communicate the decision or rectification to third parties. If neither the accuracy nor the inaccuracy of the data can be established, the data controller will add a note to the data indicating that it is disputed.

Receiving or transferring data

The new Federal Data Protection Act (nLPD) introduces a right to the delivery and transmission of personal data, enabling the individuals concerned to receive or transfer their data in a common electronic format.

This right, also known as "portability", is designed to ensure that the data can be easily accessed by the public.

This right, also known as the portability of data, applies to certain data processed by the data controller, subject to exceptions set out in the law. The right to portability facilitates the mobility of data between different services or platforms, such as music, telephony, webmail, sport, health, the social network or banking.

This right does not apply to the processing of personal data.

This right is not yet explicitly mentioned in the DPA. 

The law

Right to hand over or transmit personal data (Art. 28 nLPD)

  1. The data subject may ask the data controller to provide him or her with the personal data concerning him or her that he or she has communicated to the data controller in a commonly used electronic format where the following conditions are met:
    1. the controller processes the personal data by automated means;
    2. personal data is processed with the consent of the data subject or in direct connection with the conclusion or performance of a contract between the data subject and the controller.
  2. The data subject may also request the controller to transfer personal data concerning him or her to another controller, provided that the conditions of para. 1 are met and that this does not require disproportionate efforts.
  3. The data controller shall remit or transmit personal data free of charge. The Federal Council may make exceptions, in particular if the remittance or transmission of personal data requires disproportionate effort.