European Union Residents

If you are in the EU and you interact with the University of Maryland in the context of this website, then our processing of your personal information may fall under Regulation 2016/679 (the General Data Protection Regulation, or the “GDPR”) and under the legal framework of Directive 2002/58/EC (“ePrivacy” Directive). In these circumstances and as applicable, the University of Maryland may be the controller of the processing of your personal data. Please see also privacy.umd.edu for more information.

When you interact with the University of Maryland, personal information is transferred to the United States. The United States is not currently among the countries outside the European Union that have obtained an adequacy decision from the European Commission reflecting an adequate level of data protection. To enable a lawful transfer of personal data from the EU, the University of Maryland relies on the derogations laid out in Article 49 GDPR. Be advised that we provide safeguards for the information transferred, as required by the GDPR itself and in accordance with this website privacy notice.

When we process personal information, we will endeavor to have a valid lawful ground for processing in place. We process personal information relying on different lawful grounds for processing, depending on the context of the processing activity.

Specifically, the personal data initially collected from you are collected and processed as necessary for the performance of the contract under which the university provides related services and/or employment or for a legitimate business or educational interest. Thereafter the continued collection and processing of personal data of enrolled students or employees of the University of Maryland is undertaken where it is necessary for legitimate interests pursued by the university or a third party (in such case, the legitimate interests will relate to the efficient, lawful, and appropriate delivery of services, and will not operate to the detriment of the rights of individuals); for the purposes of the performance of a legal obligation; where necessary to protect your vital interests (e.g., the safety and well-being) or those of another party; where it is necessary for performing a task in the public interest or in the exercise of official authority (e.g., a disclosure for the benefit of public health concerns); or as it is necessary for the performance of the contract. If one of these lawful bases do not apply, we will seek the consent of the EU resident to whom the personal data belongs.

“Special Category Data”, also known as sensitive personal data, is subject to additional controls. This includes data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or orientation, and health data.

We hold such data with respect to EU residents who are applicants to, enrolled students of, or employees of the University of Maryland in order to implement and manage services and processes including but not limited to recruitment, administration, registration, examinations, graduation, academic and extracurricular programs and activities, accommodations, support, counseling, health care, career counseling, training, professional development, certification, and other services. Without this information, the university might not be able to provide its services to these individuals or to others. Such information is transmitted between and among university units for operational reasons as is necessary and appropriate for the intended purposes.

When the University of Maryland processes an EU resident’s Special Category Data, and where the EU resident has not made the information public, we will seek and must obtain your (the EU resident’s) explicit consent unless we require the data for (1) the protection of your vital interests or those of another person; (2) the exercise or defense of a legal claim; (3) a substantial public interest; or (4) the purposes of medical or health care.

The University of Maryland is committed to facilitating the exercise of the rights granted to you by EU data protection law (the right to access your data, to ask for erasure, correction, restriction, portability of your data or to object to the processing of your data) in a timely manner for personal information that properly falls under the GDPR.

In order to be able to reply to requests for the exercise of rights, and if we are not certain of your identity, we may need to ask you for further identification data to be used only for the purposes of replying to your request. If you have any inquiries or requests, please write to umd-privacy@umd.edu. 

We strive to promptly respond to requests and will do our best to address your concern. However, if you believe we have not been able to deal with your concern appropriately, you have a right to complain to your local data protection authority. You also have the right to submit a complaint in the member state of your residence or place of work of an alleged infringement of the GDPR.