2.1 Lawful Basis for Collecting or Processing Personal Data

Georgia Tech has a lawful basis to collect and process personal data. Most of Georgia Tech’s collection and processing of personal data will fall under the following categories:

1. Processing is necessary for the purposes of the legitimate interests pursued by Georgia Tech or by a third party.
2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
3. Processing is necessary for compliance with a legal obligation to which Georgia Tech is subject.
4. The data subject has given consent to the processing of his or her special categories of sensitive personal data for one or more specific purposes.

There will be some instances where the collection and processing of personal data will be pursuant to other lawful bases

2.2 Data Protection & Governance

Georgia Tech will protect all personal data and special categories of sensitive personal data that it collects or processes for a lawful basis. Any personal data and special categories of sensitive personal data collected or processed by Georgia Tech shall be:

1. Processed lawfully, fairly, and in a transparent manner
2. Collected for specified, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes
3. Limited to what is necessary in relation to the purposes for which they are collected and processed
4. Accurate and kept up to date
5. Retained only as long as necessary
6. Secure

2.3 Sensitive Personal Data & Consent

Georgia Tech must obtain consent before it collects or processes special categories of sensitive personal data.

2.4 Individual Rights

Individual data subjects covered by this policy will be afforded the following rights:

1. information about the controller collecting the data
2. the data protection officer contact information (if assigned)
3. the purposes and lawful basis of the data collection/processing
4. recipients of the personal data
5. if Georgia Tech intends to transfer personal data to another country or international organization
6. the period the personal data will be stored
7. the existence of the right to access, rectify incorrect data or erase personal data, restrict or object to processing, and the right to data portability
8. the existence of the right to withdraw consent at any time
9. the right to lodge a complaint with a supervisory authority (established in the EU)
10. why the personal data are required, and possible consequences of the failure to provide the data
11. the existence of automated decision-making, including profiling
12. if the collected data are going to be further processed for a purpose other than that for which it was collected

Note: Exercising of these rights is a guarantee to be afforded a process and not the guarantee of an outcome.

Georgia Tech must respond to Open Records Act requests as required by the Open Records Act, O.C.G.A. § 50-18-70 et seq. (the “ORA”). With limited exceptions, Georgia Tech must respond to such requests within three business days. In response to an ORA request, Georgia Tech will allow the requester to view public documents and, for a fee, make copies.

Institute Communications (IC) has been designated by the President of Georgia Tech as the office responsible for responding to ORA requests on behalf of the custodian of the records. Departments and school, as custodians of Georgia Tech’s records, must work in cooperation with IC to ensure Georgia Tech’s compliance with the ORA. The custodian of the records remains responsible for compliance with the ORA and for any civil or criminal penalties imposed for failure to comply.

Departments, schools, faculty or staff who receive an ORA request from any person, or an ORA inquiry from IC, shall respond promptly, following the procedures in this policy.

Individuals with access to Georgia Tech’s personal data assets are responsible for ensuring such information is collected, maintained, and used by Georgia Tech only for purposes that are relevant and necessary to perform the job or task that reasonably serves a legitimate Georgia Tech function. Such collection, maintenance and use must also comply with applicable laws and regulations, Georgia Tech policies, and USG requirements governing privacy of information.

Management and Access to PII
Individuals with responsibility for Records containing Personally Identifiable Information (PII) should only Process or seek to access such PII as appropriate in the performance of their assigned role or duties for Georgia Tech and in accordance with all applicable laws and regulations, Georgia Tech policies, and USG requirements. Access to PII as part of an individual’s assigned responsibilities or role does not constitute authority to release such information to other employees, students, parents or guardians, or third parties.

Both units and individuals are responsible for protecting PII against accidental or intentional misuse or improper disclosure or exposure within or outside of Georgia Tech. For more information concerning safeguarding Institute Records and PII, see the Cyber Security Policy, the Protected Data Practices resource, and the Security Procedures and Standards resource. Concerns regarding the security and safeguarding of PII can be reported to the Georgia Tech Cyber Security Teamhttps://security.gatech.edu/report-incident.

Georgia Tech shall not use social security numbers, driver’s license numbers, passport numbers or other governmental-issued numbers or designations as an official Institute personal identifier unless required by applicable law or reviewed and approved by the Risk Panel.

Processing PII

Individuals with responsibility for Processing PII must be able to identify and articulate the following:

• whose PII is being Processed (what group or population of individuals)
• why the PII is being Processed (the purpose(s) or business need for the Processing),
• how that Processing will take place (the Processing activity),
• and who has access to the PII being Processed.

This includes Processing within Georgia Tech as well as external to Georgia Tech (third parties such as vendors and contractors).

Where appropriate and practicable, persons Processing PII should implement the principle of Data Minimization, and if possible, Disassociate and De-identify datasets that include PII.

The President of the Institute may designate officials of the Institute to execute Agreements in the name of The Board of Regents of the University System of Georgia by and on behalf of the Georgia Institute of Technology. This designation by the President can be accomplished only by a written delegation of authority. Such delegation of signature authority by the President shall apply only to the incumbent (or interim) in the position named in the written delegation, or in any successor title to the named position.

Unless authority is expressly delegated by the President, an individual does not have authority to bind the Institute. The President of the Institute may periodically issue a memorandum or other writing to confirm the conditions under which other officials of the Institute have been authorized to enter in to binding contracts on behalf of the Institute. A Delegation of Presidential Authority Memorandum will supersede and replace all prior delegations.

The official exercising the delegated signature authority is authorized to execute only those Agreements that are specified in the written delegation. All such agreements must first be reviewed by the Office of the General Counsel (OGC) prior to signature unless the OGC has created a template document for the signatory's use.

An official may not further delegate their delegated signature authority.

This policy does not address Purchasing Agreements which will be reviewed, approved, and executed by Georgia Tech Purchasing.

The Institute’s employees, contractors, representatives, and others having responsibility for installing, maintaining, having access to, having the capability of viewing, or otherwise having the ability to utilize VMS and video surveillance devices associated with any real property owned, leased or occupied by the Institute, or any entity with a Georgia Tech affiliation, shall utilize said video surveillance devices in a manner consistent with the U.S. Constitution, United States Federal law, Georgia State law, City of Atlanta municipal ordinances, Georgia Tech Police Department’s (hereafter “GTPD”) “Video Surveillance” policy, and Institute “Ethics” policy.

Installation of any video surveillance devices shall be coordinated with either GTPD’s Physical Security Specialist or the Georgia Tech Research Institute’s (hereafter “GTRI) Research Security Department in order to ensure video surveillance devices are not placed or positioned in such a way as to compromise a person’s expectation of privacy.  No one is authorized to install security controls, to include video surveillance devices, web cams or other intrusive electronic devices used for surveillance, without the proper coordination with either the GTPD or GTRI Research Security Department.

The installation and monitoring of all such video surveillance devices shall be solely for the legitimate purposes of protecting human life, personal property, and the Institute’s interests and assets.

Recorded images shall not be made public, nor shall recorded images be released to, provided to, or otherwise made accessible to, any person, party or entity inside or outside of the Institute, without the Institute’s express permission, or as required by law.

All requests to obtain recorded images must be submitted through the Georgia Tech Police Department Records Division.