What rights do I have with regard to my registered personal data?

You have the following rights with respect to the processing of your personal data (Articles 12 – 23 of the General Data Protection Regulation, GDPR):

  • The right to be informed about which personal data the Netherlands Institute for Human Rights processes about you;
  • The right of access to records containing your personal data;
  • The right to rectification, restriction, or erasure of your personal data;
  • The right to object to the processing of your personal data;
  • The right to withdraw consent for the processing of your personal data;
  • The right to lodge a complaint regarding the processing of your personal data.
  • The above rights do not apply to the processing of personal data in the context of a submitted request for investigation into possible discrimination under the equal treatment legislation (the judgment procedure).

For the publication of non-binding decisions of the Institute, specific “publication rules” apply, which safeguard the privacy of the (natural) persons concerned.

The Institute does not engage in automated decision-making or profiling within the meaning of Article 22 of the GDPR. The rights concerned are therefore not applicable. The same applies to the right to data portability (Article 20 GDPR).

Exercising privacy rights

Privacy request

You may submit a privacy request to the Netherlands Institute for Human Rights, for the attention of the Privacy Officer. Download the privacy request form (PDF), complete it, and submit it by email (privacy@mensenrechten.nl) or by post to:

Netherlands Institute for Human Rights

Attn. the Privacy Officer

P.O. Box 16001

3500 DA Utrecht

The Netherlands

The Institute may only provide you with information relating to your own personal data and not that of other data subjects.

Important: the form is intended exclusively for questions concerning the personal data processed about you by the Institute.

If your request concerns a(n ongoing) case regarding (in)equality of treatment, your rights are limited. You cannot, by invoking the rights listed above, obtain a copy of your entire case file, correct the substance of your case, or object to it. This is only possible during the procedure itself and after publication of the decision. A separate procedure applies in such cases (a regular request for access). Please contact the Institute directly.

Content of a privacy request

A privacy request must in any event include the following information:

  1. Full name and initials
  2. Date of birth
  3. Residential address
  4. Postal code and city
  5. Telephone number
  6. Where applicable, the file number or opinion number
  7. The substance of the request, which may include:
    • an overview of the personal data the Institute holds about you;
    • an overview of your personal data disclosed to other authorities;
    • access to your personal data in the case you submitted;
    • restriction of access to your personal data;
    • temporary suspension of data recording;
    • temporary suspension of newsletter distribution;
    • objection to the processing of your personal data;
    • rectification of your personal data;
    • supplementation of your personal data;
    • (non-)erasure of your personal data;
    • any other amendment to your personal data (specifying the requested change).
  8. The reason for your privacy request.

Registration and acknowledgement of receipt

Upon receiving your request, the request will be registered and you will receive an acknowledgement of receipt. The request will then be handled and assessed by the Privacy Officer.

Identification requirement

The Netherlands Institute for Human Rights often processes sensitive data. If you request an overview of personal data or request changes to your data, the Institute must verify your identity. This is to prevent unauthorized disclosure or modification of your data.

For this reason, the Privacy Officer (or another staff member) will contact you by letter, email, or telephone to explain how further identification will take place.

Time limits

After identification, your request will be processed immediately (or as soon as possible). In any event, you will be informed within one month of receipt of the request about its outcome. The Institute may grant or refuse the request; in both cases, the decision will be reasoned.

In the case of complex requests or a large number of requests, this period may be extended by two months. You will be informed of such an extension within one month of receipt of the request.

Costs

In principle, the Institute does not charge a fee for handling your request. However, if your request is excessively extensive, you may be asked to pay a reasonable fee, determined on the basis of the scope of the request.

Questions

If you have questions about submitting a privacy request or how it is handled, you may contact the Privacy Officer of the Institute by phone or email.

Telephone: +31 (0)30 888 3888

Email: privacy@mensenrechten.nl

If you have a question for the Data Protection Officer of the Institute, please email fg@mensenrechten.nl

Lodging an objection

If you disagree with the Institute’s decision on your privacy request, you may lodge an objection with the Director of the Institute. The objection must be submitted within six weeks of notification of the decision (Article 6:7 Dutch General Administrative Law Act, Awb).

The notice of objection must in any event include (Article 6:5 Awb):

  1. The name and address of the appellant;
  2. The date of submission;
  3. A description of the decision against which the objection or appeal is directed;
  4. The grounds of the objection.

In principle, the Director will decide on your objection within six weeks of receipt (Article 7:10(1) Awb). If you disagree with the decision on your objection, you may appeal to the administrative court. The time limit for lodging an objection or appeal with the administrative court is six weeks.

Lodging a complaint

If you wish to lodge a complaint about the processing of your personal data by the Institute, or if you are dissatisfied with the handling of your request, you may submit a complaint to the supervisory authority (the Dutch Data Protection Authority, Autoriteit Persoonsgegevens) or initiate legal proceedings before the courts.