Supplemental Privacy Provisions for Persons in the European Union and for those traveling to the European Union

A. Applicability and Definitions

These Supplemental Privacy Provisions for Persons in the European Union (EU Privacy Provisions) are provided pursuant to Regulation (EU) 2016/679 (“Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data”) (the GDPR), effective May 25, 2018.

These EU Privacy Provisions supplement Maricopa County Community College District’s (MCCCD) Statement on Privacy (https://district.maricopa.edu/regulations/admin-regs/section-4/4-22) and should be read together with MCCCD’s Privacy Statement. These EU Privacy Provisions are intended to be consistent with the GDPR principles of privacy, fairness, lawfulness, transparency, purpose limitation, accuracy, storage limitation, integrity, and accountability. For more information regarding the GDPR and these principles, please see: https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en#legislation. Terms in these EU Privacy Provisions are used consistent with their definitions in the GDPR.

These EU Privacy Provisions apply to you only if and to the extent MCCCD or one if its associated college is Processing your EU Personal Data, where the Processing is related to MCCCD offering goods or services to you, or MCCCD is monitoring your behavior in the EU (e.g., through online course proctoring, or location tracking).

Personal Data means any information, recorded in any form, relating to you that can identify you, directly or indirectly, such as your name, date of birth, addresses (including email addresses), identification numbers, location data, online identifiers, or factors specific to your physical, physiological, genetic, mental, economic, cultural, or social identity.

EU Personal Data means Personal Data you submit or disclose to MCCCD (or to a third party that transfers it to MCCCD for Processing) while you are in the European Union (EU).

Processing (and Process) includes collecting, recording, organizing, storing, transferring, sharing, disclosing, erasing, or destroying your EU Personal Data, whether or not via MCCCD’s technology network.

MCCCD may Process your EU Personal Data in accordance with these EU Privacy Provisions, MCCCD’s Statement on Privacy (https://district.maricopa.edu/regulations/admin-regs/section-4/4-22) as permitted or required by law. If you do not agree with these EU Privacy Provisions, please do not provide any EU Personal Data to MCCCD. If you choose not to provide any EU Personal Data that is necessary for MCCCD to provide you with specific products or services, MCCCD may not be able to provide those products or services to you.

B. EU Personal Data MCCCD Collects and How We Use It

Collection of Your EU Personal Data. MCCCD collects EU Personal Data from you:

  • When you apply for admission to MCCCD from the EU
  • When you enroll or participate, from the EU, in classes or programs given by MCCCD, online or in person
  • When you register from the EU for an online account from MCCCD, or update or change, from the EU, information for your account
  • When you participate from the EU in MCCCD classes or programs using MCCCD’s websites and technology network, such as when you turn in assignments and projects online, use online courseware or proctoring services, participate in online discussions and forums, and communicate with MCCCD faculty and staff
  • When you send MCCCD emails and other communications from the EU
  • When you inquire about or apply for employment with MCCCD from the EU
  • When you, from the EU, complete a survey for, submit information to, or request information from, MCCCD
  • When you are working for MCCCD in the EU

Use of Your EU Personal Data. MCCCD may use your EU Personal Data to respond to your questions, provide you specific courses, services, products, programs and/or services you select, satisfy our contractual obligations to you, send you updates and information regarding MCCCD, send you email messages about maintenance or updates of MCCCD’s technology network, and to support of MCCCD’s alumni relations and fundraising. We may also: archive your EU Personal Data; use it for research and analytics purposes; use it for future communications with you; use it to establish, exercise, and defend legal claims; use it for reasons of substantial public interest, including archiving purposes; use it for historical, scientific, research, or statistical purposes, subject to appropriate safeguards; and use it for the legitimate interests of MCCCD or any third party to whom MCCCD discloses your EU Personal Data, if your fundamental rights and freedoms do not override those interests.

Lawfulness of Processing. MCCCD’s Processing of your EU Personal Data for the interdependent purposes set out in these EU Privacy Provisions is necessary for one or more of the following:

  • Pursuing MCCCD’s legitimate interests
  • Carrying out a task in the public interest
  • Exercising MCCCD’s official authority as a constitutionally created institution governed by the Arizona Board of Regents, a body corporate of the sovereign State of Arizona, in the United States of America
  • Performing a contract with you, or to take steps at your request prior to contracting with you
  • Protecting your vital interests or the interests of another person
  • Complying with MCCCD’s legal obligations

C. Specific Guidance

In addition to the information provided above, this Section provides additional information regarding how MCCCD Processes your EU Personal Data in specific situations.

Applications for Student Admissions from the EU. This part applies if, while you are in the EU, you apply for admission as a student to MCCCD (including as an exchange or visiting student), whether you intend to attend MCCCD online, remotely, or on campus, and whether you submit your application through MCCCD’s online student application portals, through a third party, or directly via communications with an MCCCD department, program, or school. MCCCD may use the details you provide on your application, together with any supporting documents you submit, additional details and documents provided by any references or third parties, including education records and financial aid applications and records, and any records made by MCCCD during the application process.

In addition to the uses described in Part B above, we will process the EU Personal Data obtained during your application process for the purposes of identifying you, processing your application, verifying the information provided, deciding whether to offer you admission, and communicating that outcome. We may also use or disclose this information for the following statutory or public interest purposes: to prevent or detect fraud; for disciplinary or academic integrity proceedings; to meet reporting obligations, such as to state or federal Departments of Education; to help us to make reasonable decisions regarding accommodations for a disability, as requested by you; and for research and statistical purposes, but none of your EU Personal Data that can identify you will be published.

We consider the Processing of your EU Personal Data in connection with your student application process to be necessary for us to take steps with a view to creating a contractual relationship with you (e.g., to assess your application to study with us), necessary for compliance with a legal obligation, or necessary for the performance of tasks we carry out in the public interest (e.g., admissions research). We require you to provide MCCCD the information we request during the application process to assess your application properly.

As well as circulating your application and related materials to the appropriate people at MCCCD, we may share your EU Personal Data, as relevant and necessary, with your references, with entities that provide services to, or on behalf of, MCCCD, and with governmental organizations. If you are accepted, MCCCD will include in your MCCCD student files the EU Personal Data collected during your application process.

Enrollment and Participation in Programs and Courses while in the EU - Overview. MCCCD offers the opportunity to participate in MCCCD courses and programs while you are in the EU, including while traveling, and online through MCCCD’s technology network. If you desire to participate in an MCCCD course or program in the EU, you will be asked to provide certain Personal Data necessary for admission, registration, enrollment, and participation in the course or program. This information may include, among other things, your name, email address, date of birth, and registration information. Enrollment and participation in MCCCD courses and programs and receipt of related services while you are in the EU is a contractual obligation between MCCCD and you, and MCCCD will need your EU Personal Data to deliver these services to you.

In addition to the uses described in Part B above, we use the EU Personal Data we collect from you when you enroll and participate in MCCCD courses or programs while in the EU for Processing purposes, including tracking attendance, progress, and completion of a course or program. We may also share your EU Personal Data and your performance in a course or program with the instructors, teaching assistants, and other individuals designated by MCCCD to assist with the creation, modification, or operation of the courses or programs, and for research and statistical purposes, but none of your EU Personal Data that can identify you will be published.

Online. If you participate in courses or programs while in the EU on or through MCCCD’s technology network, we will collect from you certain student-generated content, such as assignments you submit to instructors, peer-graded assignments and peer grading student feedback. We also collect course data, such as student responses to in-video quizzes, stand-alone quizzes, exams, and surveys, online proctoring data and information, and other course, program, and degree related information.

Study or Travel Abroad. MCCCD travel and study abroad programs include academic and other MCCCD programs (such as travel with an MCCCD team or academic group). If you are an MCCCD student participating in an MCCCD travel or study abroad program, MCCCD requires that you sign a GDPR Contract and Consent before your leave the United States. MCCCD’s Contract and Consent allows MCCCD to use your Personal Data collected while you are in the EU. MCCCD also needs to be able to Process your Personal Data regarding your coursework as necessary to maintain your educational and degree records consistent with MCCCD policies, legitimate pedagogical purposes, and any applicable laws, rules, regulations, and policies.

Disclosure of Student Personal Data. The United States Family Educational Rights and Privacy Act (FERPA), Arizona law, and MCCCD policy provide MCCCD students with the right to limit access to their Personal Data. Due to the GDPR's requirements, if you are participating in MCCCD courses or programs on or through MCCCD's technology network while you are in the EU, MCCCD will endeavor to restrict third parties from access to your EU Personal Data that is directory information, as described and defined under FERPA’s Directory Information list at https://district.maricopa.edu/consumer-information/family-educational-rights-privacy-act-ferpa . MCCCD may disclose EU Personal Data that is confidential student information with your consent, under subpoena or court order, or to comply with other legal obligations to which MCCCD is subject.

MCCCD Employment in the EU. If you are an MCCCD employee who is working for MCCCD while in the EU, MCCCD will maintain, retain, protect, and Process your personnel records. If you request in writing to the MCCCD Human Resources Department, MCCCD will endeavor to withhold from publication in the MCCCD Directory your EU Personal Data that is ”Directory Information." Directory Information, such as your name, title, academic unit or department, campus location, and campus telephone number. MCCCD may disclose your EU Personal Data, which includes disclosure with your consent, under subpoena or court order, or to comply with other legal obligations to which MCCCD is subject.

Employment with MCCCD while you are in the EU is a contractual obligation between MCCCD and you, and MCCCD’s duties as an employer are subject to Arizona laws, and MCCCD policies. MCCCD will need your Personal Data to comply with applicable laws, rules, regulations, and policies, as well as to fulfill MCCCD’s contractual obligations to you.

In addition to the uses described in Part B above, MCCCD may use an MCCCD employee's EU Personal Data to carry out specific rights and obligations in the context of employment law or laws relating to social security and employee benefits, to protect your vital interests or the vital interests of another person if you are incapable of giving consent, to carry out public functions, and for research and statistical purposes.

Applications for MCCCD Employment from the EU. If, while you are in the EU, you apply for a position with MCCCD through MCCCD’s online employment portal or directly via communications with an MCCCD department or school, MCCCD may use the details you provide on your application form, together with any supporting documents you submit, additional details and documents provided by any references, and any records made by MCCCD during the employment process. If you are required to undergo additional background checks or procedures as part of the employment process (e.g., criminal convictions checks or visa application procedures), we will collect and use this information as well. Specifics regarding what background checks and other documentation and information MCCCD may require can be found at the MCCCD Human Resources website.

In addition to the uses described in Part B above, MCCCD will process your EU Personal Data obtained during your employment process for the purposes of identifying you, processing your application, verifying the information provided, assessing your suitability for the position, deciding whether to offer you a job, and communicating that outcome. We may also use or disclose this information for the following statutory or public interest purposes: to prevent or detect fraud; to help us to make decisions regarding accommodations for a disability that are requested by you; and for research and statistical purposes, but no EU Personal Data that can identify you will be published in connection with research or for statistical purposes.

We consider the Processing of your EU Personal Data in connection with the employment process to be necessary for us to take steps with a view to creating a contractual relationship with you (e.g., to assess your application for employment), necessary for compliance with legal obligations (e.g., equal opportunity monitoring, or disability accommodations), or necessary for the performance of tasks we carry out in the public interest. We require you to provide us with the information we ask for during the employment process to assess your application properly.

As well as circulating your application and related materials to the appropriate people at MCCCD, we may share your EU Personal Data, as relevant and necessary, with your references, and with entities that provide services to, or on behalf of, MCCCD, such as background checks. If you are hired, MCCCD will include in your personnel employment files EU Personal Data collected as part of your employment process.

MCCCD Alumni in the European Union. Developing a better understanding of our alumni allows MCCCD to keep in touch, to keep alumni apprised of MCCCD’s activities and developments, to provide services to alumni, and to identify ways alumni can support MCCCD, through donations or other forms of financial and non-financial support.

Identity Verification. MCCCD may require or offer you the ability to verify your identity before we provide certain services (such as resetting passwords, or releasing certain information), or for selected classes and programs. To verify your identity, MCCCD may require you to provide EU Personal Data, such as your name, address, date of birth, a headshot taken using a webcam, a photo identification document, and a sample of your typing patterns. We use the Personal Data we collect for verifying your identity, and for authenticating that submissions made on MCCCD's technology network were made by you.

Enrollment Sponsors. MCCCD may share your EU Personal Data with your employer, government programs, institutions, or other enterprises that sponsor your enrollment in a course or program for training or other educational purposes. If an entity pays for or otherwise sponsors your course or program participation, MCCCD will share information with the entity as needed to confirm your enrollment, participation, progress, and completion status in that course.

MCCCD Service Providers. MCCCD may contract with non-MCCCD service providers, vendors, and contractors (Contractors) to assist MCCCD in providing services. These Contractors may have access to and may collect or otherwise Process your EU Personal Data as necessary to perform the services for MCCCD. These Contractors, for example, may provide MCCCD with network, website, platform, server, technology, services, course and program content and delivery, and administrative and student-related services, such as those related to providing MCCCD study abroad or other courses or programs offered to individuals in the EU. Access to your EU Personal Data by these Contractors is limited to the information reasonably necessary to perform their contracted functions. MCCCD requires Contractors to protect Personal Data on our behalf. We do not permit third parties to sell Personal Data we have shared with them.

Transfer to Third Parties. MCCCD will transfer your EU Personal Data to third parties only where MCCCD is comfortable that they will protect your EU Personal Data. Where we know that a third party we have provided EU Personal Data to is Processing that EU Personal Data in a manner contrary to the GDPR, we will take reasonable steps to prevent or terminate Processing by that third party unless and until the third party can Process EU Personal Data in compliance with the GDPR.

Government Authorities, Legal Rights and Actions. MCCCD may share your EU Personal Data with various government authorities in response to subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. MCCCD also may share your EU Personal Data when we believe it is appropriate to investigate, prevent, or take action regarding unlawful or suspected illegal activities; to protect and defend the rights, property, or safety of MCCCD, MCCCD's technology network, MCCCD's students, employees, and others.

MCCCD Server Locations. MCCCD's websites, technology network, and online course platforms that contain your EU Personal Data are primarily operated and managed on servers located within the United States.

EU Personal Data Retention and Storage. MCCCD may permanently store and maintain, among other things, your name, subject(s), enrollment, registration and graduation details, unique MCCCD identification number, date of birth, verification, residency, affidavits, financial aid, grades, classes, courses, transcripts, disciplinary, and degree and employment related records containing your EU Personal Data: (i) to comply with MCCCD's obligations to you, including taking steps to enter into an employment, enrollment, or other contract with you; (ii) to comply with MCCCD's legal obligations; (iii) for reasons that are in the public interest; (iv) to comply with MCCCD's records retention policies https://district.maricopa.edu/regulations/admin-regs/section-4/4-15. If you exercise your right to erMCCCDre, we will continue to maintain a core set of your EU Personal Data, to ensure we do not contact you inadvertently in the future, to maintain your academic record for reference and archival purposes, and to meet our legal obligations.

D. Your Rights Regarding Your EU Personal Data

You have certain rights regarding your EU Personal Data, subject to certain exclusions as described in the GDPR. Your rights include:

  • The right to be informed of how your EU Personal Data are being used – this information is set forth in these EU Privacy Provisions and any documents linked to these EU Privacy Provisions
  • The right of access to your EU Personal Data
  • The right to have your inaccurate EU Personal Data rectified
  • The right to have your EU Personal Data erased
  • The right to restrict the Processing of your EU Personal Data pending its verification or correction
  • The right to object to the Processing of your EU Personal Data
  • The right to receive copies of your EU Personal Data
  • The right to file a complaint with an EU supervisory authority
  • The right to object to using your EU Personal Data for direct marketing, data mining, or research purposes where the research is not in the public interest

A response to a rights request needs to be sent within one month. However, nearly all of your rights are qualified in various ways and there are numerous specific exemptions (for example, almost all of the rights do not apply if your EU Personal Data are being processed solely in an academic research context).

Contact Information, Rights Requests. If you wish to exercise any of your rights regarding your EU Personal Data, please contact MCCCD’s GDPR data protection team at protectprivacy@domail.maricopa.edu. You may also file a complaint concerning your EU Personal Data Processing with the applicable EU Supervisory Authority. The Supervisory Authority Contact Information for all EU countries is at: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

If you have specific requests relating to how MCCCD Processes your EU Personal Data, we will endeavor to resolve these, but there may be circumstances where MCCCD cannot comply with specific requests.

We will publish on our website any changes we make to these EU Privacy Provisions.

Effective: 5.25.2018