Policy 5.10 - General Data Protection Regulations Privacy Policy

Date: August 18, 2025, Resolution #25-72

Supersedes:
August 19, 2024, Resolution #24-122

Background Information

The General Data Protection Regulations ("GDPR") were adopted by the European Commission in order to strengthen and unify data protection for all individuals within the European Union ("EU").

GDPR became effective on May 25, 2018, and applies in European Economic Areas ("EEA") which includes the EU members and the countries of Iceland, Liechtenstein, and Norway.

GDPR:

  • Extends jurisdiction with extra-territorial applicability.
  • Provides for penalties for non-compliance.
  • Establishes stronger conditions for seeking informed, explicit consent.
  • Provides additional rights for data subjects, including mandatory data breach notification and data.

The Executive Vice President of Administration and Finance and Chief Information Officer are responsible for monitoring and maintaining this policy.

Purpose

SUNY Schenectady County Community College (hereafter referred to as "SUNY Schenectady “or “the College") is committed to respecting and protecting the privacy rights of persons in the European Economic Area ("EEA"), comprised of the European Union ("EU") and the countries of Iceland, Norway, and Lichtenstein, pursuant to the EU General Data Protection Regulation ("GDPR"). This privacy policy outlines how SUNY Schenectady collects, processes, discloses and uses information that is shared with College through its websites, other electronic systems, paper forms, and otherwise provided by individuals while in the European Union Member State and the countries of Iceland, Liechtenstein and Norway, regardless of citizenship or residency.

Definitions 

Personal Information/Data: information relating to a personally identifiable individual.

Personal information/data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Some examples of personal information/data, according to the GDPR, are an individual's name, email address, phone number, transcript, academic record, student organization membership, work history, work performance, letters of recommendation, demographic information, documentation provided to support financial aid applications, donor information, IP addresses, browser and computer information - such as a cookie ID, how users interact with College’s website and electronic communications, and in some cases medical and health information and information observed as part of a research study.

Sensitive Information: information about an individual that is classed as "sensitive" or "special category" personal data which requires additional protections. This includes information concerning ethnicity, sexual orientation, religious beliefs, or health/disability that is used for planning and monitoring purposes, or in order to provide care, help or suitable adjustments. For certain courses of study, other sensitive information may be processed, such as information about past criminal convictions, working with children or vulnerable adults, and fitness to practice in certain regulated professions.

Statements 

Personal Information SUNY Schenectady Collects

SUNY Schenectady collects Personal Information in order to fulfill its mission as a public institution of higher education. The College requires Personal Information only when necessary.

In addition to this, the College may process personal information that is classed as "sensitive" or "special category" personal data, which requires additional protections. This includes information concerning ethnicity, sexual orientation, religious beliefs, or health/disability that we use for planning and monitoring purposes, or in order to provide care, help, or suitable adjustments. For certain courses of study, other sensitive information may be processed, such as information about past criminal convictions, working with children or vulnerable adults, and the fitness to practice in certain regulated professions.

Access to, and the sharing of, "sensitive" personal data are carefully controlled. Further details about the use of any such data will be provided by the College when it is collected.

Applicability of this GDPR Privacy Notice 

This GDPR Privacy Notice applies to any person if all of the following factors are met:

  • They are a natural person-not a corporation, partnership, or other legal entity-who is physically present in the EEA.
  • "Personal Information" (any information that relates to or identifies them as is further described below) provided they are physically present in the EEA.
  • Such Personal Information is provided to SUNY Schenectady while they are physically inside the EEA; and,
  • Such Personal Information is provided to SUNY Schenectady:
    • During the course of the College offering any goods or services to them,
    • While the College is monitoring their behavior or health,
    • While they are associated with any of SUNY Schenectady's programs,
    • While they are participating in clinical research programs; or
    • While they are receiving health treatment.

Please note that information pertaining to current, former, or prospective employment with the College within the United States is not considered "Personal Information" under this policy and is excluded from this GDPR Privacy Notice.

Legal Basis for Processing Personal Information 

The College’s processing activities of Personal Information may rely on different lawful grounds depending on the circumstances. Generally speaking, the College typically will rely upon one or more of the following lawful bases to process Personal Information under the GDPR:

  • Necessity to enter or for the performance of a contract (e.g., online applications, information provided when enrolling, or for payment information to pay tuition)
  • Necessity of the College's legitimate interests or those of third parties (e.g., evaluation of candidates for admissions, financial aid, and/or maintain a community for alumni)
  • Necessity of the College’s compliance with legal requirements imposed by state or federal law
  • Consent (e.g., for the research projects you may participate in, for processing of special categories of personal data)

The College considers the processing of Personal Information to be either necessary for the performance of its contractual obligations (e.g. to manage the student’s education, student experience and welfare while studying at SUNY Schenectady's), necessary for compliance with a legal obligation ( e.g., visa monitoring), necessary for the performance of tasks the college carries out in the public interest ( e.g., teaching and research), or necessary for the pursuit of the legitimate interests of the College's or an external or affiliated organization (e.g., to enable access to external services). The College requires any information reasonably asked for be provided to enable it to administer its relationship with the student. If the College requires consent for any specific use of personal information, it will be collected at the appropriate time, and it can be withdrawn at any time. Where the College asks for any "sensitive" information, such as that concerning ethnicity, sexual orientation, religious beliefs or health/disability, there is usually the option to refuse consent by not supplying it.

How SUNY Schenectady Obtains Personal Information 

SUNY Schenectady obtains Personal Information:

  • From individuals, the Data Subjects: The College may receive Personal Information while visiting the College's website, apply for or attend classes or programs, apply for or take online courses, travel with the College to a location in the EEA, attend events sponsored by the College in the EEA, participate in clinical research, voluntarily or involuntarily receive medical treatment or services, or otherwise interact with the College in the EEA. 
  • From Third Parties: The College may also receive Personal Information from third parties. Examples include, without limitation, exam scores received from testing agencies, and registration information received from third parties that administer online courses. The College also may receive information from other individuals or institutions who provide treatment and services, from public health services, from law enforcement, and from other clinical researchers, as well as from those who process the information provided on behalf of these entities.
  • Prospective Students – The College uses Personal Information in order to consider a potential student for admission to a campus or a particular program, to award financial aid and merit-based scholarships, and to track the effectiveness of our communications and programs.
  • Students – The College uses Personal Information to provide higher education services, comply with our legal obligations, enforce SUNY Schenectady policies and procedures, and to improve the overall student experience on the campus, and effectiveness of the College’s programs. Some examples of these include the registering of classes, tracking attendance, evaluating academic performance, submitting required reports to federal and state regulatory authorities and accrediting bodies, providing academic and career advising, providing housing and food services, evaluating student organizations, evaluating academic programs, and providing letters of recommendation and transcripts to prospective employers or other institutions.
  • Alumni and Friends – The College uses Personal Information to track, maintain, and evaluate the College’s relationships, providing communications and invitations to campus events, assisting with obtaining employment or admission to another educational institution or program, and to evaluate academic and employment outcomes.
  • Prospective Employees – The College uses Personal Information to consider individuals for employment, evaluate the effectiveness of the College’s recruitment programs, establish minimum requirements for positions, and to improve the attractiveness of the College as an employer.
  • Current Employees – The College uses Personal Information to perform necessary tasks related to the status as an employee, to contact the appropriate person in the event of an emergency, to investigate violations of SUNY Schenectady policy, to improve the overall employment experience at the College.
  • Research and Work-Study Participants – The College uses Personal Information to fulfill the objectives of a particular research or work study project, and to provide any promised compensation or other incentives.

Certain Personal Information collected by SUNY Schenectady is required for the College to be able to provide educational services, employment, or treatment as a patient. In the event such information is not provided, the College may be unable to provide the requested services.

Use of Personal Information

How the College uses Personal Information depends upon the context in which it was provided.

SUNY Schenectady may use Personal Information for other purposes and will provide specific information at the time such alternate use arises.

Sharing of Personal Information

The College does not sell Personal Information and only shares Personal Information with third parties if there is a legitimate institutional need to do so. The College may share Personal Information with the following recipients:

  • With SUNY System Administration and other campuses within the SUNY System in order to govern, administer, and improve the SUNY system.
  • With the College’s affiliated entities including the College Foundation, Faculty Student Association, Student Government Association, and other affiliated entities in order to provide ancillary services.
  • With the College’s service providers that need access to Personal Information in order to provide SUNY Schenectady with services necessary to fulfill the College’s mission or improve the student or employee experience.
  • With accrediting agencies in order to obtain or maintain accreditations for the College and its affiliates various programs.
  • With the Federal, State, and local governments or regulatory authorities as required by law or as necessary to fulfill the mission of the College.

Please note that the SUNY Schenectady may provide anonymized data developed from Personal Information to third parties, such as government entities and research collaborators, and that such anonymized data is outside the scope of this GDPR Privacy Notice. 

SMS opt-in and phone numbers collected for SMS communication purposes will not be shared with any third party and affiliates for marketing purposes.

Rights Regarding Personal Information

SUNY Schenectady is committed to facilitating the exercise of the rights granted by the GDPR in a timely manner. In the context of the College’s processing activities that are subject to the GDPR, the following are the rights regarding personal information:

  • Access, correction, and other requests – Individuals have the right to obtain confirmation of whether the College process their personal data, as well as the right to obtain information about the personal data College processes about them. They have a right to obtain a copy of this data. Additionally, and under certain circumstances, they may have the right to obtain erasure, correction, restriction, and portability of their personal data.
  • Right to object - Individuals have the right to object to receiving marketing materials from the College by opting out or notifying the College’s Director of Student Affairs, as well as the right to object to any processing of their personal data based on their specific situation. In the latter case, the College will assess the request and provide a reply in a timely manner, according to its legal obligations.
  • Right to withdrawal consent - For all the processing operations that are based on an individual’s consent, they have the right to withdraw their consent at any time, and the College will stop those processing operations as allowable by law.

In addition to the rights provided by the GDPR, individuals may also have rights with respect to their Personal Information pursuant to U.S. federal law, state law, and/or SUNY Schenectady policy. These include, without limitation, policies pertaining to student education records and policies pertaining to certain health records that the College maintains.

In order to exercise any of these rights, except the right to file a complaint with an EU supervisory authority, the request should be submitted to the College’s Director of Student Affairs.

Please note that when making requests based on these rights, if the College is not certain of the identity of the person making the request, the College may need to ask for further personal information to be used only for the purposes of replying to the request.

Security of Personal Information 

SUNY Schenectady implements appropriate physical, technical, and organizational security measures to protect Personal Information consistent with the requirements of law and the policies of the SUNY Schenectady Board of Trustees.

Retention and Destruction fo Personal Information 

The College will retain Personal Information for as long as there is a legitimate need to do so and in accordance with the SUNY Schenectady Records Retention and Disposition Policy, and applicable federal and state law. Retention periods vary and are established considering the College’s legitimate interests and all applicable legal requirements.

Data Transfer Outside of the Area 

SUNY Schenectady is based in the United States and is therefore subject to U.S. and New York State law. Personal Information that is provided to the College will generally be hosted on U.S. based servers. To the extent that the College needs to transfer personal information either (a) from the EEA to the U.S. or another country or (b) from the U.S. to another country, SUNY Schenectady will do so on the basis of either (i) an "adequacy decision" by the European Commission; (ii) EU-sanctioned "appropriate safeguards" for transfer such as model clauses, a copy of which may be requested, if applicable, by contacting the College as set forth below; (iii) the explicit and informed consent; or (iv) it being necessary for the performance of a contract or the implementation of pre-contractual measures with SUNY Schenectady measures generally requested (e.g., for the transfer of personal data necessary for application for admission). Please note that the U.S. is not currently considered a safe harbor country under the GDPR.

Applicable Legislation and Regulations 

General Data Protection Regulations 

Family Educational Rights and Privacy Act

Related References, Policies, Procedures, Forms and Appendices 

If there are any concerns or questions regarding this notice or how Personal Information is used, please contact the College’s Chief of Staff at 518-381-1385 or the Office of Student Affairs at 518-381-1344. SUNY Schenectady will attempt to promptly address any concern about its data collection and use policies. However, if it is believed the College has not been able to deal with the concern appropriately, a compliant can be made to the local data protection authority, as granted by Article 77 of the GDPR. A complaint may also be submitted in the Member State of residence, place of work, or of an alleged infringement of the GDPR.

In the event sensitive information is passively collected during a transaction that has occurred for the performance of the College’s contractual obligations (e.g. to manage education, student experience and welfare while studying at SUNY Schenectady), that is necessary for compliance with a legal obligation ( e.g., visa monitoring), necessary for the performance of tasks we carry out in the public interest ( e.g., teaching and research), or necessary for the pursuit of the legitimate interests of SUNY Schenectady or an external organization (e.g., to enable access to external services), the sensitive information will be redacted before the documents are processed.

SUNY Schenectady Related Policies 

5.4 - Information Security Incident Investigation, Response, and Notification Policy
5.5 - Information Security Policy
5.7 - Internet Privacy Policy
6.7 - Payment Card Industry Data Security Standard Policy (PCI-DSS)