hi welcome to another episode from our GDPR IQ thought leadership series
here we'll be discussing the steps colleges and universities need to take
towards GDPR compliance the GDPR has a wide territorial scope and may
catch campuses not established in the EU if your campus uses elearning tools for
courses offers remote access to students in the EU or monitors the progress of EU
students at those campuses then your higher education institution needs to
take steps towards compliance North American universities are still
unraveling what the legislation means for their overseas programs the data
they collect on students and employees who are au citizens for universities
achieving gdpr compliance will invariably result in tangible benefits
enhanced data security improve data management and a competitive
differentiation from organizations that lag behind in gbbr compliance the
education business will be well-prepared for the California consumer privacy act
or C CPA and other regulations with similar requirements for consent the
right to be forgotten data breach notification and so on universities
collect vast amounts of personal data on students and staff including names email
addresses physical addresses financial information and health information the
gdpr imposes restrictions on the manner in which personal data is collected use
and maintenance of data and the ability to collect certain items of personal
data without specific consent the legislation applies to any university
that has students from EU countries or employees professors administrative and
support staff etc students studying abroad in EU countries under certain
circumstances research grants from EU countries donations from alumni who are
citizens of EU countries and exchange programs with EU universities
consequently the GDPR compliance journey inherently forces organizations
to review current data collection procedures and to revise existing
privacy and security policies the extent of these reforms depends on the scope of
the personal data collection a university maintains the gdpr
introduces the accountability principle in most cases the university will be a
data controller and therefore is responsible for demonstrating compliance
with all the requirements of the gbbr including the principles of lawfulness
and transparency purpose limitation minimization accuracy storage limitation
integrity and confidentiality transfers and data subject rights as the data
controller you must be in position to provide evidence to support compliance
with this principle as a first step you need to document what data you have
where it comes from how you use it and who has access to it etc and undertake a
thorough and exhaustive data and information audit to create an
information asset register to reduce your liability
we recommend disposing of any data that you determine is no longer required this
can be a challenging step for universities different departments tend
to operate independently to some degree data collected and stored by
universities may include family income used to determine scholarship
eligibility demographic data used to further diversity efforts academic
records health information records of website use and research religious
affiliation records of extracurricular memberships and activities records of
alumni donations photographs and other personal data associated with student
IDs for many colleges and universities
complying with the gdpr will require changes both on a strategic
level and tactical level including data collection how it's used marketing
processes consent forms privacy notices etc however affirmative steps towards
gdpr compliance and overall data hygiene can be taken instantly thanks for
watching the gdpr 4 universities video subscribe to our channel for more on how
to tackle the EU GDPR and feel free to watch more videos from our GDPR IQ
series here don't forget to check out our website or follow our social
channels thanks again looking forward to seeing
you