Educause Security Discussion mailing list archives

Re: GDPR Question - Part 2


From: "Madl, Michael" <michael.madl () INDWES EDU>
Date: Thu, 8 Feb 2018 21:43:44 +0000

I don’t believe any EU student’s data could be retained under Fed Fin Aid policy --- To obtain FinAid they would have 
to be a noncitizen, in the US (which would then not be subject to GDPR since they are in the US) for a non-temporary 
purpose with the intention of becoming a US citizen or perm resident – This would preclude the student from having the 
right to have their data expunged under GDPR.

Note:
“A US entity involved in a data transaction with an EU resident in the US, for example, would not be subject to the 
GDPR; the same entity engaging in significant and intentional cyber-transactions with EU residents would be”

Like Karl I am eager to hear other’s thoughts and interpretations!


From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Karl 
Kowalski
Sent: Thursday, February 8, 2018 4:12 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] GDPR Question - Part 2

But if I'm not mistaken, the Federal Financial Aid retention policy would serve as your "legal basis" for data 
retention. And should an EU citizen ask to be expunged, that data could still be retained for the retention period. You 
would just need to document that and inform the customer.  But would like to hear others' thoughts/interpretations if 
I'm wrong..

Karl

On Thu, Feb 8, 2018 at 12:06 PM, Madl, Michael <michael.madl () indwes edu<mailto:michael.madl () indwes edu>> wrote:
I had the same thought (approach) but after speaking to financial aid in regards to Fed retention requirements (I 
believe it is 3 years from the end of the award year) I don’t think a broad brush approach will work for all students.

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () 
LISTSERV EDUCAUSE EDU>] On Behalf Of Hart, Michael
Sent: Thursday, February 8, 2018 3:57 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] GDPR Question - Part 2

I was under the impression that the GDPR protections applied to EU citizens while they are in the EU.  Regardless of 
where our systems and data are residing, the citizenship and location of the individual is what we were told to focus 
on.

I find it daunting to sort through the various directions different interpretations take us.  I am working with our GC 
and shared governance groups to get a campus interpretation we can work with.  I think we’ll be trying to provide this 
GDPR treatment to all data, as I think it’s easier than trying to cherry pick whose data was relevant during which time 
period.

The good news is this is getting attention from our GC office, and they’re really starting to focus on records 
retention and data governance overall, not just specific compliance issues.  I’m astounded by the number of departments 
that haven’t heard of GDPR.

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Theresa 
Rowe
Sent: Thursday, February 8, 2018 1:09 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] GDPR Question - Part 2

Around January 8, there was an interesting discussion about the scope of records covered by GPDR.  At one point, John 
Denune summarized it nicely as:
From the EDUCAUSE/Tambellini Group webinar, one of the scenarios presented involved a US faculty member visiting 
Finland on sabbatical. While in Finland, the scenario concluded that:

  *   All personal data the faculty member sends back to the home institution falls under GDPR
  *   This includes the personal data of her US PhD students that she may send back to the US
  *   This also may include all personal data she has with her when she returns to the US.

So let's say you've determined the scope with your GC.  As an IT professional, what are you doing to comply?
At this point, we are documenting our existing data privacy owners, our security officer, our policies on privacy, and 
reusing existing policy.  Are you finding an big action that requires attention?
Theresa Rowe
Chief Information Officer
Oakland University


On Mon, Jan 8, 2018 at 9:50 AM, Pardonek, Jim <jpardonek () luc edu<mailto:jpardonek () luc edu>> wrote:
Good Morning,

We have been having some discussions regarding what population’s records are subject to GDPR.  The discussion centers 
around whether or not the records of US citizens that study abroad fall under GDPR.  Some say it’s only those who are 
citizens of the EU.  Is there any guidance on this topic?

Thanks and have a great day.

Jim

James Pardonek, MS, CISSP, CEH
Information Security Officer
Loyola University Chicago
1032 W. Sheridan Road | Chicago, 
IL<https://maps.google.com/?q=1032+W.+Sheridan+Road+%7C+Chicago,+IL%C2%A0%C2%A060660+%0D+*+%0D+(**:+(773*&entry=gmail&source=g>
  
60660<https://maps.google.com/?q=1032+W.+Sheridan+Road+%7C+Chicago,+IL%C2%A0%C2%A060660+%0D+*+%0D+(**:+(773*&entry=gmail&source=g>

•: 
(773<https://maps.google.com/?q=1032+W.+Sheridan+Road+%7C+Chicago,+IL%C2%A0%C2%A060660+%0D+*+%0D+(**:+(773*&entry=gmail&source=g>)
 508-6086

Loyola University Chicago will never ask your for your username or password.
For the lastest information security news at Loyola, please follow us online,
Twitter: @LUCUISO
Facebook: https://www.facebook.com/lucuiso/
Our Blog http://blogs.luc.edu/uiso/

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () 
LISTSERV EDUCAUSE EDU>] On Behalf Of Joanna Grama
Sent: Monday, October 2, 2017 9:16 AM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: [SECURITY] October 24 GDPR Webinar from Tambellini Group and EDUCAUSE

Good morning,
Many of us continue to struggle with understanding the scope and finer points of the EU GDPR and its application to US 
higher education institutions. To that end, EDUCAUSE and the Tambellini Group have been working together to share more 
information on this topic and we are pleased to announce an upcoming webinar that you may be interested in.

The jointly sponsored webinar will be held on Tuesday, October 24, 2017, from 1-2pm ET.  You can register for the 
webinar and read more about the webinar content here:  
https://marketing.thetambellinigroup.com/acton/media/10722/gdpr-and-us-higher-education-institutions-webinar

As GDPR questions have been coming up on our various EDUCAUSE lists, we have been sharing those questions with the 
Tambellini group so that they can be specifically addressed in the upcoming webinar.

Kind regards,
Joanna

(This message has been cross posted on the EDUCAUSE security, privacy, and IT GRC discussion listservs.)

Joanna Grama, JD, CISSP, CRISC, CIPT
Director of Cybersecurity and IT GRC Programs

EDUCAUSE
Uncommon Thinking for the Common Good
282 Century Place, Suite 5000, Louisville, CO 
80027<https://maps.google.com/?q=282+Century+Place,+Suite+5000,+Louisville,+CO+80027&entry=gmail&source=g>
direct: 720.406.6769<tel:(720)%20406-6769> | cell: 720.507.5983<tel:(720)%20507-5983> | jgrama () educause 
edu<mailto:jgrama () educause edu>

Become a Member- Everyone at your organization is an EDUCAUSE member when you join | Access discounts, resources, and 
valuable peer networks | Discover membership<https://www.educause.edu/about/discover-membership>






--
Karl Kowalski, Chief Information Technology Officer
University of Alaska
Office of Information Technology
2025 Yukon Drive, Suite 103
Fairbanks, Alaska  99775

Phone: 907-450-8383
http://www.alaska.edu/oit

__________________________________________________

This e-mail and any documents transmitted with it are confidential and intended solely for use of the individual or 
entity to whom they are addressed. If you are not the named addressee you should not disseminate, distribute, or copy 
this e-mail. Please notify the sender immediately if you have received this e-mail by mistake. If you are not the 
intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance of the 
contents of this information is strictly prohibited.

Current thread: