The GDPR gives you the right to request:
- A copy of your personal data that was processed by ISU with your consent, or was provided to ISU to fulfill a contract with you. ISU reserves the right to refuse a copy of financial information of a parent or guardian, letters of recommendation if you waived your right of access to such letters, data that was collected and maintained before May 25, 2018, and data that is excluded under the GDPR.
- Rectification of your data if it is inaccurate, misleading, or incomplete. If ISU decides not to comply with the request, the Data Subject will be advised of the right to challenge the decision through a hearing before an ISU hearing officer who is a disinterested party. Both the Data Subject and ISU may present relevant evidence. The hearing officer will render a written decision based upon the information presented at the hearing. If the hearing officer does not believe the data is inaccurate, misleading, or incomplete, the Data Subject has the right to present a written statement to be included with the Data Subject’s file.
- Restriction in the use of data if the data was processed unlawfully but the Data Subject does not want it erased, the Data Subject shows that ISU does not have a legitimate interest in the data, or the data is no longer needed by ISU, but the Data Subject needs it for a legal claim.
- Erasure of your information in accordance with all applicable laws. ISU will comply if the data is no longer necessary for the purpose in which it was collected, consent to use the data has been withdrawn and there is no legal basis to permit the use of the data (this does not affect the lawfulness of ISU’s use of the information prior to receipt of your request,) the student’s interest in erasure outweighs ISU’s interest, the student objects to use of data for profiling related to marketing, or the data was processed unlawfully. The erasure of your information shall be subject to the retention periods in accordance with the State of Idaho Records Retention Schedule https://www.isu.edu/records/ and applicable federal laws.
You may exercise any of these rights by emailing firstname.lastname@example.org with the request. Once a request has been made, ISU will respond within thirty (30) days of receipt of the request. ISU reserves the right to extend the period of time to respond by giving written notice to the Data Subject of the reason for the delay and the new response date. If ISU fails to respond within the first thirty (30) days, the Data Subject may file a complaint with the appropriate EU authority.
Educational records are governed by the Family Education Rights and Privacy Act (FERPA). ISU will disclose such FERPA records with the Data Subject’s consent; however there are situations where records may be disclosed without consent to:
- School faculty and staff who have a need to know to fulfill their official responsibilities
- Other schools to which the Data Subject is transferring
- Accrediting organizations
- Organizations doing certain studies for or on behalf of the University
- Appropriate parties in connection with financial aid to a student
- Parents, when a student over eighteen (18) is still a dependent
- Certain government officials in connection with local, state, or federally-supported education programs
- Individuals who have a court order or subpoena
- Faculty and school officials who have a need to know concerning disciplinary action taken against a student
- Persons who need to know in cases of emergencies when necessary to protect the health and safety of the Data Subject and/or others
- State and local authorities to whom disclosure is required by state law
- Directory information