TU Delft ignores warnings and puts sensitive data of (former) students in the cloud

Dutch citizen service numbers, bank details and even medical information… TU Delft moved data belonging to (former) students to the cloud, including information that should already have been deleted under privacy law. University magazine Delta reports this.

Many universities of applied sciences and universities in the Netherlands use the Osiris information system. Students use it, for example, to register for classes and exams. It also stores personal data such as addresses, bank account numbers and academic results.

Delft University of Technology also uses Osiris. In November last year, the institution decided to move the data to a cloud environment in the Netherlands. In other words, it was moved off the university’s own servers.

The personal data of around 267 thousand (former) students and applicants were transferred. But this included data that should have been deleted, an investigation by university magazine Delta has found.

Stored indefinitely

Under the GDPR, organisations are required to delete personal data “as soon as they are no longer necessary for the original purpose for which they were collected”. A university may not, therefore, keep the data of its (former) students indefinitely.

Delta also reports that medical information was found in Osiris. Students sometimes had to upload medical certificates or dyslexia assessments, for example, to request extra time in an exam. According to the university, Osiris is not intended for this purpose, but this did happen in practice.

TU Delft was warned several times before the move to clean up the data first. However, the warnings were ignored. An expert told Delta that the university could be fined by the Dutch Data Protection Authority.

Tech giants

Other universities are also increasingly storing data in the cloud rather than on their own servers. This brings another risk: by handing over control of data management, universities lose some control over the data.

Osiris is owned by an American company. Earlier this year, universities said they wanted to become less dependent on American tech giants.