GDPR

GDPR Privacy Notice

The University of Hawai‘i (“UH”) is committed to safeguarding the privacy of personal data. This GDPR Privacy Notice explains how UH processes your personal data and your rights regarding your personal data under the General Data Protection Regulation (“GDPR”), a European Union privacy law. 

Applicability 

This GDPR Privacy Notice applies to all data subjects, defined in GDPR as identifiable natural persons, whose personal data is collected by UH while the data subject is physically present in the European Economic Area (“EEA”). The EEA is comprised of 27 member countries of the EU—Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden—plus Iceland, Liechtenstein, and Norway. If you were located in any of these EEA countries AT THE TIME you provided UH with your personal data, this GDPR Privacy Notice will apply to you. 

Lawful Basis for Collecting and Processing Personal Data

As the state university and body corporate of the State of Hawai‘i, UH has a lawful basis to collect, process, use, and maintain personal data of its applicants, students, employees, graduates, research subjects, and others involved in its educational, research, and community programs. The lawful bases include, without limitation (1) admission, (2) registration, (3) administration and delivery of classroom, online, and study abroad courses, (4) academic performance and grades, (5) communications and correspondence, (6) financial aid, (7) campus housing, (8) identification and security, (9) eligibility to participate in athletics, health, or other services, (10) employment, (11) research and development, and (12) records retention. Examples of the types of personal data collected and processed include, without limitation, name, contact information (such as email address, IP address, physical address or other location identifier, phone number), date of birth, academic history and performance, employment history and performance, criminal and disciplinary history, financial history, photos, and other information you provide or that UH is required or authorized by applicable law to collect and process.

UH will only collect, process, use, and maintain the personal data collected (1) with your consent, (2) for the performance of a contract to which you are or will be a party, (3) for compliance with legal obligations, (4) for the protection of vital interests including health and safety, (5) for the performance of a task carried out in the public interest, or (6) for the legitimate interests of UH that do not outweigh your fundamental rights and freedoms.

Sharing Personal Data

UH may share your personal data with third parties under a memorandum of agreement where the sharing of such personal data is in compliance with GDPR and other applicable laws, necessary or desirable for the foregoing purposes and bases, and is safeguarded and protected in a commercially reasonable manner.

Retention Period of Personal Data

Your personal data will be retained for no longer than is necessary in accordance with applicable federal and state laws and UH policies.

Your Rights as a Data Subject

For personal data that is subject to regulation under GDPR, you have the following rights:

• Right of Access –the right to request a copy of your personal data.
• Right of Rectification – the right to correct your personal data that is inaccurate.
• Right of Erasure (“Right to be Forgotten”) – the right, in certain circumstances, for your personal data to be erased from UH records.
• Right to Restrict Processing – the right, when certain conditions apply to you, to restrict the processing of your personal data.
• Right to Data Portability – the right to have your personal data transferred to another organization or entity.
• Right to Object – the right to object to certain types of processing such as direct marketing or research purposes not in the public interest.
• Right to Object to Automated Processing – the right to object to a decision based solely on automated processing or profiling.
• Right to Review – the right to obtain a reason should UH refuse your requests under any of the above rights, including the right to file a complaint as set forth below.

Please note that the above rights are not absolute, and UH may be entitled to refuse requests where exceptions or special circumstances apply. UH may also request the provision of additional information necessary to confirm the identity of the data subject making any such request. Should UH determine that you are not entitled to exercise any rights, UH will provide you with the reason(s) for denial.

Complaints

Any complaints about your personal data should be sent to the Director of the UH Data Governance and Operations Office who has been designated as the Data Protection Officer for the purposes of GDPR: