EU General Data Protection Regulation Compliance Policy

Lawful Basis for Collecting or Processing Personal Data

Georgia College has a lawful basis to collect and process personal data. Most of Georgia College’s collection and processing of personal data will fall under the following categories:

Processing is necessary for the purposes of the legitimate interests pursued by Georgia College or by a third party.
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Processing is necessary for compliance with a legal obligation to which Georgia College is subject.
The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

There will be some instances where the collection and processing of personal data will be pursuant to other lawful bases.

Data Protection & Governance

Georgia College will protect all personal data and sensitive personal data that it collects or processes for a lawful basis. Any personal data and sensitive personal data collected or processed by Georgia College shall be:

Processed lawfully, fairly, and in a transparent manner
Collected for specified, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes
Limited to what is necessary in relation to the purposes for which they are collected and processed
Accurate and kept up to date
Retained only as long as necessary
Secure

Sensitive Personal Data & Consent

Georgia College must obtain consent before it collects or processes sensitive personal data.

Individual Rights

Individual data subjects covered by this policy will be afforded the following rights:

information about the controller collecting the data
the data protection officer contact information (if assigned)
the purposes and lawful basis of the data collection/processing
recipients of the personal data
if Georgia College intends to transfer personal data to another country or international organization
the period the personal data will be stored
the existence of the right to access, rectify incorrect data or erase personal data, restrict or object to processing, and the right to data portability
the existence of the right to withdraw consent at any time
the right to lodge a complaint with a supervisory authority (established in the EU)
why the personal data are required, and possible consequences of the failure to provide the data
the existence of automated decision-making, including profiling
if the collected data are going to be further processed for a purpose other than that for which it was collected

Note: Exercising of these rights is a guarantee to be afforded a process and not the guarantee of an outcome.

Definitions

The following definitions apply to the terms as used in this Policy:

Collect or Process Data	Collection, storage, recording, organizing, structuring, adaptation or alteration, consultation, use, retrieval, disclosure by transmission/dissemination or otherwise making data available, alignment or combination, restriction, erasure or destruction of personal data, whether or not by automated means.
Consent	Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Under the EU GDPR: Consent must be a demonstrable, clear affirmative action. Consent can be withdrawn by the data subject at any time and must be as easy to withdraw consent as it is to give consent. Consent cannot be silence, a pre-ticked box or inaction. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Request for consent must be presented clearly and in plain language. Maintain a record regarding how and when consent was given.
Controller	The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Georgia College Unit	A Georgia College college, school, office or department.
Identified or Identifiable Person	An identified or identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural or social identity of that person. Examples of identifiers include but are not limited to: name, photo, email address, identification number such as GC ID#, GC Account (User ID), physical address or other location data, IP address or other online identifier.
Lawful Basis	Processing of personal data shall be lawful only if and to the extent that at least one of the following applies: The data subject has given consent to the processing of his or her personal data for one or more specific purposes; Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; Processing is necessary for compliance with a legal obligation to which the controller is subject; Processing is necessary in order to protect the vital interests of the data subject or of another natural person; Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
Legitimate Interest	Processing of personal data is lawful if such processing is necessary for the legitimate business purposes of the data controller/processor, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Personal Data	Any information relating to an identified or identifiable person (the data subject).
Processor	A natural or legal person, public authority, agency or other body who processes personal data on behalf of the controller.
Sensitive Personal Data	Special categories of personal data that require consent by the data subject before collecting or processing are: Racial or ethnic origin Political opinions Religious or philosophical beliefs Trade union membership Genetic, biometric data for the purposes of uniquely identifying a natural person Health data Data concerning a person’s sex life or sexual orientation

Keywords

European Union

General data

Reason for Policy

Georgia College & State University (“Georgia College” or the “GC”) is an institute of higher education involved in education, research and community development. In order for Georgia College to educate its foreign and domestic students both in class and on- line, engage in world-class research, and provide community services, it is essential and necessary, and Georgia College has a lawful basis, to collect, process, use, and/or maintain the personal data of its students, employees, applicants, research subjects, and others involved in its educational, research, and community programs. These activities include, without limitation, admission, registration, delivery of classroom, on- line, and study abroad education, grades, communications, employment, applied research, development, program analysis for improvements, and records retention.

Georgia College takes seriously its duty to protect the personal data it collects or processes. In addition to Georgia College’s overall data protection program, the European Union General Data Protection Regulation (“EU GDPR”) imposes obligations on entities, like Georgia College, that collect or process personal data about people in the European Union (“EU”). The EU GDPR applies to personal data Georgia College collects or processes about anyone located in the EU, regardless of whether they are a citizen or permanent resident of an EU country. Among other things, the EU GDPR requires Georgia College to:

be transparent about the personal data it collects or processes and the uses it makes of any personal data
keep track of all uses and disclosures it makes of personal data
appropriately secure personal data

This policy describes Georgia College’s data protection strategy to comply with the EU GDPR.

Proposed Outcome

This policy aims to promote a consistent approach to ensuring compliance with the EU GDPR within the University. This policy standardizes the data collection process and ensures that individuals allow consent for collection of sensitive personal data. The University i s committed to ensuring the security of your information. We have put in place reasonable physical, technical, and administrative safeguards designed to prevent unauthorized access to your information.

Applicability of the Policy

This policy applies to the personal data and sensitive personal data protected by the EU GDPR and all Georgia College Units who collect or process personal data and sensitive personal data protected by the EU GDPR.

Related Policies

Procedures

Data Governance
Document Lawful Basis for Collection or Processing	All Georgia College Units who collect or process personal data protected by the EU GDPR must document the lawful basis for the collection or processing of personal data and sensitive personal data they collect or process, why they
Data Governance
	collect it, and how long they keep it using the online Georgia College EU GDPR Lawful Basis Form . All data at Georgia
	College shall be kept in compliance with the USG -BOR Records Retention Schedules .
Privacy Notice
Georgia College’s Privacy Notice	Georgia College’s Privacy Notice to data subjects must specify the lawful basis for Georgia College to collect or process personal data and include: whether their personal data are being collected or processed and for what purpose categories of personal data concerned to whom personal data is disclosed storage period (records retention period) existence of individual rights to rectify incorrect data, erase, restrict or object to processing how to lodge a complaint the source of the personal data (if not collected from the data subject) the existence of automated decision-making, including profiling A link to the Georgia College Privacy Notice is available on the footer of all Georgia College websites – “Legal & Privacy Information”. [NOTE: Georgia College Privacy Notice will be in final form by May 25, 2018]
Georgia College Units Privacy Notice	Each Georgia College Unit that collects or processes personal data protected by the EU GDPR must create and publicly post a notice, in a conspicuous location that meets the requirements of (1) through (8) above.
Consent
Documentation of Consent	Georgia College Units must obtain affirmative consent before it collects or processes sensitive personal data. Georgia College EU GDPR Consent Form
Withdrawal of Consent	Georgia College must have a process for individuals who request to withdraw their consent.
Individual Rights
Exercise of Rights	Any individual wishing to exercise their rights under this policy should contact Sadie M. Simmons-
Data Governance
	Compliance/Policy/Privacy Officer: Email address sadie.simmons@gcsu.edu.
Data Protection
Security of Personal Data	All personal data and sensitive personal data collected or processed by any Georgia College Units under the scope of this policy must comply with the security controls and systems and process requirements and standards of NIST Special Publication 800-171 as set forth in the Georgia College Controlled Unclassified Information Policy.
Breach Notification	Any Georgia College Unit that suspects that a breach or disclosure of personal data has occurred must immediately notify Georgia College Office of Legal Affairs.

Responsibilities:

Responsible Party:

Georgia College Units

To document the lawful basis for personal data or sensitive personal data collected or processed pursuant to this policy.

To cooperate with Institutional Research & Enterprise Data Management when individuals inquire about their personal data or sensitive personal data collected or processed pursuant to this policy (See Section 2.3).

To immediately notify (24/7) and cooperate with Georgia College Cyber Security relating to any data breach.

Responsible Party:

Office of Legal Affairs

To field inquiries about personal data or sensitive personal data collected from individuals while in the EU.

To coordinate with Georgia College Unit responding to inquiries about personal data or sensitive personal data collected from individuals while in the EU.

Responsible Party:

Cyber Security

To answer questions about and review data security measures.

To handle data breach notification for the university.

Creation Date: May 2018

Revision Date: N/A

Last Reviewed Date: May 2018

Next Review Date: May 2020

Responsible Department: Office of Legal Affairs

Effective Date

Up one level

Campus Affairs