Supplement to Data Privacy Notice for COVID-19 Testing

This Notice supplements NYU’s Data Privacy Notices for Students, Employees and Vendors in the E.U. (the “Notices”) by describing the practices of NYU Florence, NYU in London, and NYU Prague (each, a “Site”)  with respect to COVID-19 testing.  All terms used but not defined herein will have the meanings set forth in the Notices.  You can contact the below listed Data Protection Officer (“DPO”) or your local data protection contact as set forth in the Notices with any questions about this notice, our data collection practices, or your rights.  

The Information We Process About You

Your Site has engaged a laboratory testing service to collect and diagnose samples from you for the purposes of COVID-19 testing.  In order to facilitate testing, your Site may provide limited personal information about you to the designated testing service for your NYU academic center, including your contact information and date of birth.  Your Site will also require you to share the results of the testing with either its staff or its occupational doctor in order for you to access campus facilities.  This personal information is referred to below as the “Covered Information.”  The laboratory testing service will provide you with its own data processing notice with respect to the data that it collects about you and how it will be used.

^ Back to top

Purposes and Legal Basis for Processing Your Data

We process the Covered Information for the purpose of determining whether it is appropriate for you to report to work (if you are an employee), for you to attend classes (if you are a student), or for you to perform services on campus (if you are a vendor), or whether you may be sick with COVID-19 and should stay home to maintain a safe and healthy environment for others. The information may also be used to monitor and respond to the presence of the disease on campus and to comply with legal reporting obligations.

Our legal basis for processing the Covered Information is that we have a legitimate interest in maintaining a safe and healthy campus and in complying with laws and regulations that govern our conduct.  We may process special categories of data (i.e., health information) because such processing is necessary to protect the health and safety of our employees in the workplace and to comply with laws and regulations issued in response to the COVID-19 pandemic. 

^ Back to top

Recipients of Your Personal Information

The Covered Information will be received and processed only by employees of your Site or an Occupational Doctor who need access to carry out their job responsibilities.   The Covered Information is also processed by the testing service who is required by contract to maintain your personal information confidentially and to comply with applicable data protection laws.

^ Back to top

Data Retention

The Covered Information will be retained for six months. 

^ Back to top

Your Rights

Your rights under GDPR with the respect to the Covered Information are set out in the Notices.  Any questions about these rights may be directed to the DPO at:

Tani Raiford
c/o Data Protection Officer’s Office
10 Astor Place, room 502E
New York, NY 10003 
+1 212 998 1180 
privacy@nyu.edu

^ Back to top

Annex A: NYU Local Data Protection Contacts

^ Back to top

Annex B: National Data Protection Authorities

This list is provided for your reference, but you may file a complaint with the data protection authority in any Member State where you habitually work, live, or believe an infringement of EU data protection law occurred. You may consult a list of data protection authorities.

^ Back to top