Explanations on regulations governing student data
These regulations set out the principles which govern the handling of data of applicants for study places, students and former ETH Zurich students at all levels.
The regulations governing student data (only in German) address the handling of data accrued in the context of teaching operations. This data may, for example, serve the application and admissions processes, the issuing of academic titles or planning and statistics.
The regulations governing student data do not address the handling of data arising in the context of actual teaching, e.g. verifications of academic achievement.
The following questions will be answered:
- chevron_right Who may handle the data?
- chevron_right What data are addressed by the new regulations?
- chevron_right How is data security regulated?
- chevron_right How and where may the affected data be stored?
- chevron_right How are access rights regulated?
- chevron_right Who may pass on what data?
- chevron_right How is the archiving/storage of data regulated?
Clarification
Art. 4 sets out who has the right to handle the data of applicants and students, and to what extent. In principle the right to handle data exists in each case within the framework of the corresponding tasks.
Lecturers utilise student data in connection with course units. Examples:
- Access to personal data as far as required to fulfil the teaching task
- Grading
- Semester performance and continuous performance assessment results
Lecturers may designate proxies in eDoz. The designated proxies also gain access to the relevant student data and must adhere equally to the data protection and data security rules.
Clarification
Art. 5, Para. 1 lists the categories of applicant and student data which may be handled. These categories comprise personal details, personal identification data, application and registration data, details of the personal situation and further data. The regulations cite examples in each of these data categories.
Clarification
The provisions set out how the data of applicants and students should be protected from unauthorised access.
Student data must be treated as confidential.
With lecturers’ access to data comes the obligation to adhere to Art. 6. How they guarantee data security is their own responsibility.
Superordinate regulations apply, such as the Directive on Information Security at ETH Zurich (RSETHZ 203.25).
It is essential that student data (e.g. lists of grades) not be allowed forwarding via self-organised cloud services such as private email accounts. Storage in the Microsoft Cloud or Google Suite is only permitted via the personal ETH account.
Clarification
Access to the data is granted to the authorised persons in each case to the extent necessary for the fulfilment of the tasks. The Head of Academic Services shall assign the appropriate user role to the authorised persons. In Art. 12 Para. 2, the access restrictions are also explicitly listed. Access to data outside the defined area is generally not possible.
Via eDoz, lecturers are granted access to the data they require for the implementation of academic support processes. Further data can alternatively be obtained via the Study Administration.
Clarification
Under the Data Protection Act communication of personal data is only permitted under certain conditions.
Here admissibility may be affirmed, for example, in cases where a legal basis exists or the affected person gives their permission. Art. 14 sets out the legal basis for communicating certain data from the central student information system to third parties. Cognisance lies with Academic Services.
It follows that lecturers themselves may not pass any student data to “third parties”. The term “third parties” also includes students. This means that no lists of names or lists with student telephone numbers may (e.g.) be circulated for group work. The designated proxies listed in Art. 4, on the other hand, do not fall under “third parties”.
How is the archiving/storage of data regulated?
Article 22, Para. 2 & 3
2 Decentrally stored data is offered to the ETH Zurich Archive at the latest ten years after the respective student leaves ETH. If the Archive does not accept the data it is deleted or destroyed.
3 Exceptions, governed by special provisions, include accounting records and examination documents.
Clarification
Art. 22 regulates the archiving, deletion and destruction of data.
For details regarding examination documents, see Art. 23 of the Ordinance on Course Units and Performance Assessments at ETH Zurich (SR 414.135.1).