European Union General Data Protection Regulation (EUGDPR) – SDCL

About This Policy

Definitions

For the purposes of this policy, Montclair State University has used the following definition of terms:

Student – any person who attends or has attended Montclair State University.

Personal Data – any record created in the European Union and transferred to Montclair State University which is directly related to an identified or identifiable student, either directly or indirectly.  Examples of personal data include but are not limited to, name, photo, email address, ID number, account number, user ID, address or other location data, IP address or other online identifier, etc.

Notification

Students are notified of their EUGDPR rights in a Privacy Notice for Academic Affairs and a Privacy Notice for Student Development and Campus Life posted on the webpages for these Divisions. The EUGDPR requires the written consent of a student to release personal data in directory information.

Procedures to Copy Personal Data

Students may obtain a copy of personal data that was processed by the University with their consent, or when the personal data was provided to the University to perform a contract with the student.  The request for a copy should be made to the appropriate records custodian identified in the contract or the consent form.

Students should submit to the records custodian or an appropriate University staff person a written request that identifies as precisely as possible the personal data he or she wishes to copy, and any third party who the student authorizes to receive a copy.  The University will provide a copy to a third party if technically feasible.

Montclair State University reserves the right to refuse to permit a student to receive a copy of the following personal data:

1. Personal data that contains the financial statement of the student’s parents.
2. Personal data that contains letters and statements of recommendation for which the student has waived his or her right of access, or which were maintained before May 25, 2018.
3. Records which are excluded pursuant to the EUGDPR.

Procedure to Erase Personal Data

Students may request personal data be erased or destroyed when one of the following applies:

1. Personal data is no longer necessary in relation to the purposes for which it was collected;
2. Consent to use the personal data was obtained by the University and has been withdrawn by the student, and there is no other legal basis to permit the use of the personal data;
3. The student objects to the use of his or her personal data and the student’s interest outweighs the legitimate interests of the University;
4. The student objects to the use of the personal data for marketing or profiling related to direct marketing;
5. The student’s data was unlawfully processed; or
6. Destruction of the data is necessary to comply with EU or member state law
7. Personal data is subject to the retention periods of applicable federal law and the Record Retention Schedule adopted by the State of New Jersey, Department of the Treasury, Division of Revenue and Enterprise Services – Record Management Services that is applicable to 4 Year Colleges and Universities.  The University may not erase or destroy personal data until after the applicable retention period expires.

In addition, the EUGDPR does not permit the University to erase or destroy personal data when the personal data is necessary for the exercise of the right to freedom of expression, to comply with a legal obligation under EU or member state law to which the University is subject, to perform a task carried out in the public interest or in the exercise of official authority vested in the University, in the public interest in the area of public health, for archiving purposes in the public interest, scientific, or historical research purposes or statistical purposes, or to establish, exercise or defend legal claims.

Procedures to Correct/Supplement Personal Data

Students have the right to ask to have personal data corrected or supplemented if complete. Following are the procedures for the correction or supplementation of personal data:

1. A student must ask the appropriate official of Montclair State University to amend personal data. In so doing, the student must identify the personal data to be corrected or supplemented and specify why the student believes it is inaccurate, misleading or incomplete.
2. Montclair State University may comply with the request or it may decide not to comply if the personal data is accurate, not misleading or complete. If it decides not to comply, Montclair State will notify the student of the decision and advise the student of his or her right to a hearing to challenge the Montclair State’s decision.
3. Upon request, Montclair State will arrange for a hearing and notify the student reasonably in advance, of the date, place and time of the hearing.
4. The hearing will be conducted by a hearing officer who is a disinterested party; however, the hearing officer may be an official of the institution. The student shall be afforded a full and fair opportunity to present evidence relevant to the issues raised in the original request to amend the student’s personal data. One or more individuals, including an attorney, may assist the student.
5. Montclair State University will prepare a written decision based solely on the evidence presented at the hearing. The decision will include a summary of the evidence presented and the reasons for the decision.
6. If Montclair State University decides that the personal data is inaccurate, misleading, or incomplete, it will amend the personal data and notify the student, in writing, that the personal data has been amended or supplemented.
7. If Montclair State University decides that the challenged personal data is not inaccurate, misleading, or incomplete, it will notify the student that he or she have a right to place in the record a statement commenting on the challenged information and/or a statement setting forth reasons for disagreeing with the decision.
8. The statement will be maintained as a part of the student’s personal data as long as the contested portion is maintained. If Montclair State University discloses the contested portion of the personal data, it must also disclose the statement.

Procedure to Restrict the Processing of Personal Data

1. Students have the right to restrict the use of data when one of the following applies:
2. The accuracy of personal data is contested for a defined period that is measurable by Montclair State
3. The processing of the personal data is unlawful and the student opposes erasure;
4. Montclair State no longer needs the personal data but the student needs the personal data to establish, exercise or defend a legal claim;
5. The student demonstrates Montclair State does not have a legitimate interest in the personal data.

If Montclair State receives a request for restriction under the EUGDPR, Montclair State will discontinue processing the student’s personal data for any purpose other than storage unless the student provides consent.  Montclair State will also notify the recipients of the student’s personal data of the restriction(s) imposed.

Time to Respond

Montclair State will respond within 1 month of receipt of a request to correct, supplement, erase, restrict, copy and object to use of personal data.  This time period may be extended by 2 additional months depending upon the complexity of the request and number of requests.  Montclair State will notify the student in writing of the extension needed and the reason why.  If the University does not respond to the student within 1 month of receipt of request, the student will be notified of its right to file a complaint with the applicable EU supervisory authority and seek a judicial remedy.

Fees for Copies of Records

A copy of personal data is provided free of charge unless the request is unfounded or repetitive; in such cases the University may either refuse to respond to the request or charge a reasonable fee to reimburse it for the cost of the copying.

Custodians of Educational Records

The following is a list of the types, location and custodians of records that the University maintains

Disclosure of Educational Records

Montclair State University will disclose information from a student’s educational records only with the written consent of the student, except that records may be disclosed without consent when the disclosure is:

1. To school officials who have a legitimate educational interest in the records. A school official is:

• A person employed by the university in an administrative, supervisory, academic or research, or support staff position, including health or medical staff
• A person elected to the Board of Trustees.
• A person employed by or under contract to the University to perform a special task, such as an attorney or auditor.
• A person who is employed by the Montclair State University Police Department.
• A student serving on an official committee, such as a disciplinary or grievance committee, or who is assisting another school official in performing his or her tasks.
• A school official has a legitimate educational interest if the official is:
• Performing a task that is specified in his or her position description or contract agreement.
• Performing a task related to a student’s education.
• Performing a task related to the discipline of a student.
• Providing a service or benefit relating to the student or student’s family, such as health care, counseling, job placement, or financial aid.
• Maintaining the safety and security of the campus.

2. To officials of another school, upon request, in which a student seeks or intends to enroll. All records will be forwarded upon request by the student and with the student’s consent, with the understanding that the student has made the request and intends to enroll at another institution.

3. To certain officials of the U. S. Department of Education, the Comptroller General, and state and local educational authorities, in connection with audit or evaluation of certain state or federally supported education programs.

4. In connection with a student’s request for or receipt of financial aid to determine the eligibility amount, or conditions of the financial aid, or to enforce the terms and conditions of the aid.

5. For degree and enrollment verification wherein the consulting and reviewing institutions are considered school officials with a legitimate educational interest.

6. To state and local officials or authorities if specifically required by a state law that was adopted before November, 19, 1974.

7. To organizations conducting certain studies for or on behalf of the University.

8. To accrediting organizations to carry out their functions.

9. To parents of an eligible student who is claimed as a dependent for income tax purposes.

10. To comply with a judicial order or a lawfully issued subpoena.

11. To appropriate parties in a health or safety emergency.

12. To individuals requesting directory information so designated by the University.

13. The results of any disciplinary proceeding conducted by the University against an alleged perpetrator of a crime of violence or non-forcible sex offenses.

14. Alcohol or controlled substance. To parents or legal guardian of a student under the age of 21 in connection with use or possession of alcohol or a controlled substance in violation of federal, state or local law or of any institutional rule or policy.

Records of Requests for Disclosure

Montclair State University will maintain a record of all requests for and/or disclosures of information of personal data from a student’s education records. The record will indicate the name of the party making the request, any additional party to whom it may be re-disclosed, and the legitimate interest the party had in requesting or obtaining the information. The eligible student may review the record.

Director Information

Montclair State University designates the following items as directory information: student name, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, photographs, degrees and awards received including deans list status, most recent previous school attended, date of degree conferment, career (UG/GR), status (full-time or part-time), and classification (freshman, sophomore, junior, senior, pre-articulated, provisionally matriculated, matriculated, etc.). Primary address and/or email address will be shared with designated vendors providing the following external services to graduating students: Information about purchasing class rings, yearbooks, commencement photos. The University may disclose any of those items from personal data with written consent.

Prior Written Consent

A student must provide a signed and dated written consent before Montclair State may disclose personally data from the student’s education records, except as provided for above. The written consent must:

1. Specify the records that may be disclosed;
2. State the purpose of the disclosure; and
3. Identify the party or class of parties to whom the disclosure may be made.

Requests from students for disclosure to third parties that are sent by e-mail or by the Internet using student identification numbers and PINs may not be considered written consent for disclosure.

Sexual Offenders Disclosure

FERPA does not prohibit the disclosure of personal data provided to Montclair State University as a result of the Violent Crime Control and Law Enforcement Act of 1994. Information provided by individuals required to register with state officials as a result of that law may be disclosed in accordance with all applicable laws.

Termination of Rights

Unless otherwise so directed by the student, EUGDPR rights terminate upon the death of the student. Records can be requested by the next of kin.

View Student PoliciesView Student Development Campus Life PoliciesView All Policies