General Data Protection Regulation

GDPR Overview

The General Data Protection Regulation is a privacy law that applies to the personal information collected in or from the European Union (EU), or that is related to goods or services offered in the EU, or that involves the monitoring of individuals in the EU.

How does this affect us at FGCU?

Although this is an EU regulation, it has significant potential to impact U.S. systems. Three major categories of data are most likely to be affected: data collected on students from the EU (e.g., international students), human resources data (e.g., data collected from or on staff or faculty living or working in the EU) and marketing data (e.g., data collected from a potential student living in the EU who is interested in FGCU).

This overview provides guidance identifying business solutions where GDPR may apply. Please consult the Office of Institutional Equity and Compliance or the Office of General Counsel for further information and direction in applying GDPR.

Key Principles of GDPR

Lawfulness, Fairness and Transparency
Toggle More Info
- Personal data must be processed lawfully, fairly and in a transparent manner.
- Processing data on an appropriate lawful basis; processing data in a way people would reasonably expect; explain how data is being processed.
Purpose Limitation
Toggle More Info
Data Minimization
Toggle More Info
Accuracy
Toggle More Info
Storage Limitation
Toggle More Info
Integrity and Confidentiality
Toggle More Info
- Personal data will be processed and stored in a secure manner; and
- Personal data is processed in compliance with controlling law and if required, GDPR principles.
Accountability
Toggle More Info

GDPR Terminology

The Following Terms Are Essential Components of the Regulation

Personal Data

‘Personal Data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing

‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data Protection Officer

A Data Protection Officer is someone who is given formal responsibility for data protection compliance within a business. Not every business will need to appoint a data protection officer – you need to do so if:

Your organization is a public authority; or
You carry out large-scale systematic monitoring of individuals (for example, online behavior tracking); or
You carry out large-scale processing of special categories of data or data relating to criminal convictions and offenses.

Consent

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Data Processor

Unlike the DPA, the GDPR introduces specific responsibilities for the Data Processor. These are third parties that process data on behalf of the Data Controller and includes IT service providers.

CONTROLLER/DATA CONTROLLER

‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Right to be Forgotten

The right to erasure of personal data or ‘the right to be forgotten' enables an individual to request the deletion or removal of personal data whether there is no compelling reason for its continued processing.

Pseudonymous Data

Some sets of data can be amended in such a way that no individuals can be identified from those data (whether directly or indirectly) without a "key" that allows the data to be re-identified. A good example of pseudonymous data is coded data sets used in clinical trials.

Frequently Asked Questions

What rules govern data collection under GDPR?
Toggle More Info
1. Any collection of personal data must have a clearly defined purpose, which is prominently publicized, and the data cannot be used for any other purpose.
2. Do not collect any more data than absolutely necessary.
3. Consumers (students, parents, vendors, donors) must be informed when personal data is being collected.
4. Personal data is kept for only as long as necessary.
5. Delete data where it is no longer necessary.
6. Effectively secure all personal data being collected.
7. Maintain documentation on your data processing activities.
8. Ensure all contractors and their sub-contractors, as well as commodity and service vendors adhere to GDPR rules.
Who does GDPR impact?
Toggle More Info
What actions should I be taking to comply with GDPR?
Toggle More Info
First and foremost:

You need to determine how exposed your area or function is to GDPR. Consider the following questions and statements:
1. What are the ways someone in the EU could access you?
2. How does your department/office/function/research interact with the EU?
3. Is there any personal data involved in your work?
4. Do you monitor individuals in any way?
5. Are there any financial transactions with individuals in the EU resulting from your work?
6. What are the touchpoints?
7. Which vendors, services and internal and external websites that are used to reach into the EU.
Second:
Once you determine your potential exposure to GDPR related issues, contact the Office of Institutional Equity and Compliance to review next action steps.
What are the penalties for not complying?
Toggle More Info
Who are the EU member states?
Toggle More Info
1. Austria
2. Belgium
3. Bulgaria
4. Croatia
5. Cyprus
6. Czech Republic
7. Denmark
8. Estonia
9. Finland
10. France
11. Germany
12. Greece
13. Hungary
14. Ireland
15. Italy
16. Latvia
17. Lithuania
18. Luxembourg
19. Malta
20. Netherlands
21. Poland
22. Portugal
23. Romania
24. Slovakia
25. Slovenia
26. Spain
27. Sweden
- Norway, Iceland and Liechtenstein are European Economic Area (EEA) member countries but NOT part of the European Union, however, GDPR is applicable through the EEA agreement.
Note: The United Kingdom has its own privacy regulation as does Canada, Brazil and other countries.
What are the Rights of Individuals?
Toggle More Info
- Right to Access: Individuals generally have the right to access their personal data held by organizations.
- Right to Rectification: Individuals can request corrections to inaccurate or incomplete data.
- Right to Erasure (Right to be Forgotten): Individuals can request that their data be deleted under certain conditions.
- Right to Restrict Processing: Individuals can limit how their data is processed under certain circumstances.
- Right to Data Portability: Individuals can request that their data be transferred to another organization or to themselves in a structured, commonly used format.
- Right to Object: Individuals can object to the processing of their data for specific reasons, such as direct marketing.

Additional GDPR Resources

The following are resources that should help provide you with a better understanding of the regulation; specifically, how it relates to U.S. institutes of higher education.

Please consult the Office of Institutional Equity and Compliance or the Office of General Counsel for further information and direction in applying GDPR.