Explanations on regulations governing student data

Clarification

Art. 4 sets out who has the right to handle the data of applicants and students, and to what extent. In principle the right to handle data exists in each case within the framework of the corresponding tasks.
Lecturers utilise student data in connection with course units. Examples:
- Access to personal data as far as required to fulfil the teaching task
- Grading
- Semester performance and continuous performance assessment results
Lecturers may designate proxies in eDoz. The designated proxies also gain access to the relevant student data and must adhere equally to the data protection and data security rules.

Clarification

Art. 5, Para. 1 lists the categories of applicant and student data which may be handled. These categories comprise personal details, personal identification data, application and registration data, details of the personal situation and further data. The regulations cite examples in each of these data categories.

Clarification

The provisions set out how the data of applicants and students should be protected from unauthorised access.

Student data must be treated as confidential.

With lecturers’ access to data comes the obligation to adhere to Art. 6. How they guarantee data security is their own responsibility.

Superordinate regulations apply, such as the Directive on Information Security at ETH Zurich (RSETHZ 203.25).

It is essential that student data (e.g. lists of grades) not be allowed forwarding via self-organised cloud services such as private email accounts. Storage in the Microsoft Cloud or Google Suite is only permitted via the personal ETH account.

Clarification

Art. 9, Para. 1 lists the various ways in which data should be stored. Examples are the central student information system and correspondence data in email directories.

Clarification

Access to the data is granted to the authorised persons in each case to the extent necessary for the fulfilment of the tasks. The Head of Academic Services shall assign the appropriate user role to the authorised persons. In Art. 12 Para. 2, the access restrictions are also explicitly listed. Access to data outside the defined area is generally not possible.

Via eDoz, lecturers are granted access to the data they require for the implementa­tion of academic support processes. Further data can alternatively be obtained via the Study Administration.

Clarification

Under the Data Protection Act communication of personal data is only permitted under certain conditions.

Here admissibility may be affirmed, for example, in cases where a legal basis exists or the affected person gives their permission. Art. 14 sets out the legal basis for communicating certain data from the central student information system to third parties. Cognisance lies with Academic Services.

It follows that lecturers themselves may not pass any student data to “third parties”. The term “third parties” also includes students. This means that no lists of names or lists with student telephone numbers may (e.g.) be circulated for group work. The designated proxies listed in Art. 4, on the other hand, do not fall under “third parties”.

Clarification

Art. 22 regulates the archiving, deletion and destruction of data.

For details regarding examination documents, see Art. 23 of the Ordinance on Course Units and Performance Assessments at ETH Zurich (SR 414.135.1).