1. Privacy of UC Personal Information

As part of our commitment to protecting your privacy, this General Data Protection Regulation (GDPR) Privacy Statement (“Privacy Statement”) is designed to provide you, as a person in the European Economic Area, which includes European Union member states as well as Iceland, Lichtenstein and Norway; with information regarding the types of Personal Information that the University of California’s Human Resources departments and offices (“UC Human Resources”) collect about you. This Privacy Statement will specifically discuss the categories of data that UC Human Resources collects from its Workforce Members, which for the purposes of this document, include: University of California (UC) employees, interns, contractors, volunteers, job applicants and former employees (including UC Retirees); and how UC Human Resources uses that information. It will also describe the choices and rights that Workforce Members have with regard to the Personal Information we collect and maintain.

For purposes of the GDPR, the data controller is the Regents of the University of California.

If you have any further questions about this Privacy Statement, please contact your local privacy officer or privacy contact. Campus privacy official contact information can be found at: https://www.ucop.edu/ethics-compliance-audit-services/compliance/privacy/campus-privacy-officials.html

2. Personal Information Collected by UC Human Resources

As part of its relationship with you, UC Human Resources collects Personal Information about you.  For the purposes of this Privacy Statement, Personal Information is any personally identifiable information about you that is collected in your relationship with UC. Subject to applicable laws, Personal Information collected may include, but is not limited to:

  • Name(s);
  • Contact information (e.g., home and work addresses, personal and work email address, home and work phone numbers);
  • Marital status and family information;
  • Citizenship, visa and passport information;
  • National and government identification information (e.g., social security number, driver’s license number);
  • Banking details and payroll information;
  • Health and life insurance information;
  • Retirement benefit and pension information;
  • Learning and development training records;
  • Military service information;
  • Birth date and birth place;
  • Disability information;
  • Employment or engagement information (e.g., employee/staff identification number, job or position title, work schedule and status, compensation and related information, employment work history, work experience information, review and evaluation information, education details); and
  • Demographic information (e.g. race, ethnicity and gender).

This Personal Information is collected from you when you decide to apply for a job, enter into an employment relationship with UC, terminate your employment with UC or request to utilize a service offered to Workforce Members. We also collect sensitive Personal Information about you, with your consent, when required by applicable law.

Please consult with your UC location’s Human Resources department to obtain more specific details regarding the data elements collected about you by your UC Unit.

3. How We Use Personal Information

UC Human Resources uses Personal Information where necessary: (a) in order to perform its obligations under an employment contract or agreement with you, or other request or transaction requested by you; and (b) where necessary for the performance of UC’s legitimate interests, including where required by law (such as employment law obligations). It is in UC’s legitimate interests as an employer to manage the centralization of its data processing activities, to improve its processes as an employer and to develop best practices for providing services to Workforce Members.

UC’s collection and use of Personal Information is essential in connection with the conduct of its human resources and business functions. UC uses such Personal Information for:

  • Responding to customer service requests and questions;
  • Determining eligibility and administering insurance and retirement benefits;
  • Communicating with you via newsletters, letters, text messages or e-mail;
  • Determining eligibility for employment or engagement;
  • Implementing payroll deductions, including Social Security and income taxes;
  • Administering pay and work-related benefits;
  • Performance management;
  • Time and attendance management;
  • Establishing emergency contacts and next of kin;
  • Supporting UC information technology services;
  • Training management, and to support the design and implementation of education and training programs;
  • Maintaining facility and Workforce Member security, health, and safety, including the performance of internal audits or investigations;
  • Conducting internal quality reviews or business analyses to improve the Workforce Member/Retiree experience;
  • Complying with labor and employment statutes and other applicable laws; and
  • Managing its electronic communications services. Please refer to UC’s Electronic Communications Policy for more information regarding UC’s electronic communications (including e-mail) procedures.

4. How We Share Personal Information

UC Human Resources may share your Personal Information with the following recipients:

  • Other UC locations departments or affiliates: Other UC locations, departments or affiliates in order to provide you with a service available to Workforce Members.
  • With our suppliers: UC retains third party vendors, consultants and suppliers to help us operate and manage the services provided to Workforce Members. UC may share Personal Information with suppliers who provide us with certain human resources services, such as retirement and benefits administration, recruitment, auditing, legal, information technology, and other operational services. These suppliers assist UC in performing requests made by you or in UC’s legitimate interests to comply with legal obligations or to better understand and improve its activities as an employer. These suppliers are only authorized to access and use your Personal Information as necessary to provide these services, and will access or use de-identified information whenever reasonably possible.
  • Public and Governmental Authorities: Entities that regulate or have jurisdiction over UC, such as regulatory authorities, law enforcement, public bodies, and judicial bodies investigating and auditing fair employment practices.

If your Personal Information is shared with a third party, UC will require that the third party use appropriate measures to protect the confidentiality and security of your Personal Information.

We may also need to share your Personal Information as required to respond to lawful requests and legal processes; to protect our rights and property and those of our agents, customers, and others, including to enforce our agreements and policies; and in an emergency, to protect UC and the safety of our students, faculty, and staff or any third party.

5. Rights of UC Workforce Members in Regards to Personal Information

As required by the General Data Protection Regulation and applicable EU Member State and EEA state law, if you are located in the European Economic Area, you have a right to:

  • To be notified regarding the collection of your Personal Information, including the specific categories of data collected, how your Personal Information will be processed, the purposes of the collection and processing and whether or not your Personal Information will be transferred to a third party;
  • Access your Personal Information, as well as information relating to the recipients of your Personal Information, the purposes of processing your Personal Information, the duration for which the Personal Information will be stored, and the source of Personal Information that has not been provided by you;
  • Rectify or correct inaccurate or incomplete Personal Information concerning you, taking into account the purposes of the processing, and the right to have incomplete Personal Information completed;
  • Move your Personal Information to another controller or processor. UC will facilitate the lawful transfer of your data to the extent possible;
  • Have your Personal Information erased in certain circumstances. Please note that UC may be required to retain your Personal Information if required by state of federal law;
  • Restrict the processing of your Personal Information in certain circumstances;
  • Object to the processing of Personal Information in certain circumstances;
  • Consent to the collection and processing of your Personal Information when required by law;
  • Withdraw your consent to the processing of your Personal Information, should UC ask for your consent for the processing of your Personal Information. The withdrawal does not affect the lawfulness of processing based on your consent before its withdrawal;
  • Know whether your Personal Information is being used for automated decision-making, including profiling. In those cases, UC will give you meaningful information about the logic involved, the significance and the envisaged consequences of such processing for your data, and the right to request human intervention; and
  • Lodge a complaint with a supervisory authority.

If you would like to exercise any of your rights mentioned above, please contact your campus privacy official.

6. Security

UC takes appropriate physical, administrative and technical measures to protect Personal Information. For more information about how UC protects data, refer to Systemwide Information Security Polices and Standards.

7. Retention

UC will only retain your Personal Information for the duration necessary for the purposes of processing identified by your UC Location Human Resources department, unless there is a legal requirement to maintain it for a longer period. For further information, see UC’s Records Retention Schedule at https://recordsretention.ucop.edu.

8. International Data Transfers

In order to fulfill the intended processing purposes identified by UC’s Human Resources functions, your Personal Information will be transferred outside of the European Economic Area (EEA), specifically to the United States, which does not protect Personal Information in the same way that it is protected in the EEA. UC will undertake appropriate measures to ensure adequate protection of Personal Information, including utilizing appropriate physical, administrative, and technical safeguards to protect Personal Information, as well as executing standard contractual clauses approved by the European Commission or a supervisory authority under GDPR, or obtaining your consent, where appropriate.

9. Questions and Complaints; UC Privacy Official

If you have questions or complaints about our treatment of your Personal Information, or about our privacy practices more generally, please feel free to contact your campus privacy official.

Effective November 20, 2018; updated May 21, 2019.