The GDPR in practice, for teachers who use Compilatio MAGISTER

GDPR = General Data Protection Regulation (for personal data)

It entered into force in May 2018 and has two main objectives:

• give back control over data to data subjects
• and ensure a proper level of security for this data.

It applies to any organisation that processes personal data belonging to European nationals or any European body.

GDPR stakeholders at an educational institution

  The institution

The institution is the "data controller", in the person of its legal representative.

The data controller is responsible for the data processing that it carries out itself, and for the processing carried out for it by subcontractors such as Compilatio.

 The DPO (Data Protection Officer)

The DPO is the director of compliance and maintaining compliance at the institution.

You must identify the DPO, as he/she is your institution's point of contact in case of questions or problems related to the GDPR.

 The teacher

The teacher represents the institution with regard to students and must act in accordance with the policy defined by the institution and the DPO.

The teacher is a user of Compilatio's MAGISTER service. The software’s interface allows users to transmit requests to process data (e.g., upload a document, analyse a document, etc.). We can say that the software performs processing for "documented instructions" from the data controller.

  The student

The student provides personal data in the context of their contract with the institution, and this contract must provide for the student's consent to having their data processed.

The student is a "data subject" for the processing requested of Compilatio by the teacher, on behalf of the institution.

Exercising rights

Right of access and consultation

The right of access pertains to the documents provided by the student. From your user account, download the documents submitted by the student, and send them to the student by any means you choose. However, it is not mandatory to provide the analysis report that you generated: all personal data provided by the student is already contained in their original document.

Right of modification

To modify information about a document (author, title, comment), it is necessary to update the document's properties from the software interface.

However, it is not possible to modify the contents of a document that has already been uploaded. Therefore, it would be necessary to delete it and then upload the new version of the document.

Right of deletion

Simply delete the documents and reports in your admin interface. To delete a document fully:

• the contents of the document must be removed from the document database
• the trash bin must be emptied

Right of limitation and opposition

To exercise these rights requires deleting the relevant data.

Since Compilatio is not a document archival service, there is no need to keep documents that you do not want to process.

Right of data portability

As for the right of access and consultation, you can download the document that was submitted to you by the student, then send it by any means you choose.

Only the data initially provided by the student is to be transmitted.

If you want to ensure the portability of several dozen documents, and wish to receive this data in a "structured" format (e.g., CSV, xml, etc.): please send a request to Compilatio support, specifying the references (identifiers) of the relevant documents.

You have a maximum of one month to respond to a request to exercise these rights, so please plan ahead accordingly if you will need Compilatio's assistance.