Privacy Policy for Prospective or Enrolled Students Located in the European Union

This Privacy Policy applies to prospective or enrolled Touro University students located in the European Union.

The European Union General Data Protection Regulation (“EU GDPR”) is a regulation governing the use of personal data. It imposes new obligations on entities that control or process personal data about people who are located in the European Union. This regulation applies to entities both inside the European Union (“EU”) and outside of the EU and, applies to data about anyone in the EU, regardless of whether they are a citizen or permanent resident of an EU country.

The regulation takes effect on May 25, 2018.

Touro University is committed to safeguarding the privacy of “personal data” of present and future students (a “student” is any person who presently attends Touro University or has attended Touro University in the past). “Personal data” is defined as any record created in the EU and transferred to Touro University, which is directly related to an identified or identifiable student. Any information relating to FERPA can be found at Touro University FERPA policy

This Privacy Policy outlines the collection, use, and disclosure of personal information provided to Touro University by students.  

Students who reside in EU countries and who apply, or may apply, to Touro University will need to provide consent for collection and use of personal data. Students who have provided data-collection consent to Touro College through CommonApp or other means, do not need to provide duplicate consent.  If you are located in the EU and you have not provided consent, or you are unsure, please provide consent using the following consent form: Touro University Consent Form for Collecting Personal Data In/From European Union (PDF).

Students who participate in International Programs in EU countries will need to provide consent for collection and use of personal data.  Students who have already provided data-collection consent to Touro University, do not need to provide duplicate consent.  If you have not provided consent, or you are unsure, please provide consent using the following consent form: Touro University Consent Form for Collecting Personal Data In/From European Union (PDF).

The Data Controller, under the GDPR law and with particular reference to the safety obligations related to automatic processing of student data, is Touro University. All data will be processed by Touro College in its capacity as Data Controller with the supervision of the Chief Information Officer, who you can reach at information.security@touro.edu.

Use of Information

For purposes of this Privacy Policy, Sensitive Information is defined as race, ethnic origin, religious or philosophical beliefs, health data, sexual orientation, and criminal convictions.

Touro University departments supporting students collect and process Information and Sensitive Information from individuals who are students only as necessary in the exercise of the University's legitimate interests, functions, and responsibilities as a higher education institution.

Information is collected from students and shared with internal and external parties to: register or enroll persons in the University, provide and administer housing to students, manage student accounts, provide academic advising, develop and deliver education programs, track academic progress, analyze and improve education programs, recruit students, make regulatory reports, audit, maintain of accreditation, and other related University processes and functions. Touro University Departments supporting students also use Information and Sensitive Information to conduct general demographic and statistical research to improve the University's programs.

Sensitive Information is collected, processed, and shared internally and externally as necessary, applicable, and appropriate in order to: identify appropriate support services or activities, provide reasonable accommodations, enforce University policies, and comply with applicable laws. Information and Sensitive Information may be shared by the International Programs Office with third parties who have entered into contracts with the University in order to perform functions on behalf of the University while sponsoring or hosting programs, subject to the obligation of confidentiality and safeguarding from unauthorized disclosure.

Third Party Use of Sensitive Information

Touro University may disclose a student’s Sensitive Information and other Information as follows:

  • Consent:  Touro University may disclose Sensitive Information and other Information if it has a student’s consent to do so.
  • Emergency Circumstances: Touro University may share a student’s Information and Sensitive Information when necessary to protect the student’s interests when the student is physically or legally incapable of providing consent.
  • Employment Necessity:  Touro University may share a student’s Sensitive Information when necessary for administering employment benefits, subject to the imposition of appropriate safeguards to prevent further unauthorized disclosure.
  • Public Information:  Touro University may share a student’s Information and Sensitive Information if the student has manifestly made it public.
  • Archiving: Touro University may share a student’s Information and Sensitive Information for archiving purposes in the public interest, for historical research, and for statistical purposes.
  • Performance of a Contract:  Touro University may share a student’s Information when necessary to administer a contract the student has with the University.
  • Legal Obligation:  Touro University may share a student’s Information when the disclosure is required or permitted by international, federal, and state laws and regulations.
  • Service Providers: Touro University uses third parties who have entered into a contract with the College to support the administration of College operations and policies. In such cases, the College will share a student’s Information with such third parties subject to the imposition of appropriate safeguards to prevent further unauthorized disclosure.
  • University Affiliated Programs: Touro University may share a student’s Information with parties that are affiliated with the College for the purpose of contacting the student about goods, services, or experiences that may be of interest to the student.
  • De-Identified and Aggregate Information: Touro University may use and disclosure Information in de-identified or aggregate form without limitation.

Security

Touro University ensures that there are appropriate technical controls in place to protect your personal details. For example University online forms are always encrypted and the University network is protected and routinely monitored. Touro University undertakes regular reviews of who has access to information that it holds to ensure that your information is only accessible by relevant staff, volunteers and business partners.

If Touro University appoints an external party to undertake a screening of information, any such arrangements are subject to a formal agreement between the University and that firm has measures to protect the security of all data.

Individuals with questions about their personal data collected and processed by Touro University should contact help.touroone@touro.edu

Retention and Destruction of a Student's Information

A student’s Information will be retained by the University in accordance with applicable federal laws and the University's Record Retention Policy. A student’s Information will be destroyed upon the student’s request unless applicable law requires destruction after the expiration of an applicable retention period. The manner of destruction shall be appropriate to preserve and ensure the confidentiality of the student’s information given the level of sensitivity, value, and criticality to the University.

A Student's Rights

Students have the right to request access to, rectification of, restriction in the use of, or erasure of Information in accordance with all applicable laws. The erasure of a student’s Information shall be subject to the retention periods of applicable federal law and the University's Record Retention Policy.

If the student has provided consent to the use of his / her Information, the student has the right to withdraw consent without affecting the lawfulness of the University's use of the Information prior to receipt of the request.  Students may exercise these rights by contacting the Registrar.

Information created in the EU will be transferred out of the EU to the University. If a student feels the University has not complied with applicable foreign laws regulating such Information, the student has the right to file a complaint with the appropriate supervisory authority in the EU.

Updates to this Policy

Touro University may update or change this policy at any time. A student’s continued use of the University website and third party applications after any such change indicates the student’s acceptance of these changes.