The GDPR: What the set of EU reforms mean for the U

Last May, you probably saw a flurry of "we've updated our privacy policy" emails in your inbox. They were from companies big and small, from Google to your local gym — all reacting to the European Union's new General Data Protection Regulation (GDPR).

What is the GDPR?

The GDPR is, in a word, complex. Broadly, it's a stringent set of reforms around how organizations in the European Union (EU) collect and use personal data, meant to bolster consumers' data privacy and consent rights. It's directed at 28 countries in the EU and three additional countries that comprise the European Economic Area (EEA). Violating the GDPR carries stiff penalties.

While aimed specifically at organizations in EU member-states, it impacts any entity outside of the EU that offers goods or services to EU-based customers or businesses.

What the GDPR means at the U

Since the GDPR went into effect, Rudy Matthes, risk analyst in the Governance, Risk & Compliance (GRC) group in UIT’s Information Security Office (ISO), has been meeting with the deans of various colleges at the university. Matthes, who oversees inherent risk process at the U, explains what the new data protection framework is, how it applies here, and what support and resources are available. GDPR-related complaints, which have been few, are handled on a case-by-case basis. On campus, the process involves ISO and the Office of General Counsel (OGC); on the hospital side, it involves U of U Health's Information Privacy Office.

It's important to note, Matthes said, that the University of Utah requires personal information only when necessary. U.S. colleges and universities are prohibited from selling student information or requesting social media account information from students. Learn more in this EDUCAUSE article, and read the U’s official Privacy Statement.

Matthes said the other key thing to understand is that the GDPR applies only to those physically present in the EU.

"If you are there, you have those rights. That's the huge caveat," he said.

In business or academia, GDPR defines three basic roles in data transactions:

The subject (who the data relates to)
The controller (who decides what to do with the data)
The processor (who processes the data)

A university can be a controller or processor, when, for example, it involves Human Resources data of EU-based students. This applies to data about a student at an EU-based satellite campus, which the U does not currently have. It gets a little more complicated relative to less formal communication channels like email. Take, for example, a coach who is looking at a prospective athlete in Europe. Strictly speaking, the emails between the two are considered personal data under the GDPR.  

"We do reach out to people in the EU, whether that's prospective students, donors, or alumni who have relocated there," Matthes said.

Learn more

Matthes invites you to read the GDPR Privacy Notice. It covers the following topics in greater detail:

1. Purpose
2. Does This GDPR Privacy Notice Apply to Me?
3. What Personal Information Does the University Process?
   • General Categories
   • Special Categories
4. Why the University Processes Your Personal Information
5. How Does the University Receive Your Personal Information?
6. Who Processed Your Personal Information?
7. How Long Does the University Keep Your Personal Information?
8. What Are Your Rights as a Data Subject?
9. How to Exercise Your Rights
10. How Does the University Respond to Requests for Personal Information?
11. Existence of Automated Individual Decision-Making
12. Transfer of Personal Information Outside the EEA
13. How Do I Contact the University, the Data Controller?
14. Full GDPR (English version)
15. Updates to GDPR Privacy Notice

Other questions?

If you have additional questions or concerns related to GDPR, please email iso-grc@utah.edu.

 

Node 4 Search