Ten years of the GDPR: access to your personal data is still not routine at EUR

This year marks ten years since the General Data Protection Regulation was adopted. It gives students and staff the right to ask what personal data the university processes about them. Medical student and EM staff member Sarah de Gruijter submitted such an access request and discovered that the process doesn’t run smoothly yet.

My request began on 27 May. I googled the address where I could submit my access request. The search ‘EUR personal data’ led me to the university’s privacy statement. It sets out the types of data EUR processes, how long it keeps them and what rights students and staff have.

At the bottom was the email address of Marlon Domingus, the data protection officer. I decided that he was the person to contact. “Under Article 15 of the General Data Protection Regulation (GDPR), I request access to the personal data that Erasmus University Rotterdam processes about me”, I emailed him.

Domingus later told me there is an online portal for this. The link is also on the EUR website, in a drop-down menu on the privacy statement page, but I hadn’t noticed it. According to him, the portal has been available since the GDPR came into force and is the best way to submit access requests. Domingus independently oversees compliance with the privacy law and advises the university. My email nevertheless reached the right department through him.

The university has received 21 access requests so far this year, Domingus says. He considers that few compared with other organisations. The number is rising, though: there were 26 requests over the whole of last year and twenty in 2024. He sees two main groups of applicants: law students who want to learn how the right of access works as part of their studies, and people collecting evidence during a dismissal or employment dispute. Whatever the reason, he sees such requests as a test for the university. “For me, these kinds of requests are a measure of our reliability.”

Two months’ wait

The EUR website says that the Privacy Team handles requests within thirty days, in line with the GDPR’s legal deadline of one month. When that deadline passed without a response, I sent a reminder on 1 July.

Five days later, a privacy officer at EUR replied that I could expect a substantive response within ten working days. That response also took a little longer to arrive. I eventually received an email on 29 July with a link and a password. More than two months after submitting my request, I was able to see what personal data the university had collected about me.

Domingus says requests are often dealt with within the legal one-month deadline. Delays can occur, he says, when a request is passed between staff members or when the applicant’s identity is checked. “It is still a human process. In isolated cases, a request can get held up during the handover.” Waiting for information to confirm an applicant’s identity can also delay the process, he says. My identity was automatically confirmed using the student email address from which I submitted the request. I did not need to do anything, so that does not explain the delay.

Medical data

The file I received contained 22 categories of personal data. Much of it was predictable: my enrolment, exam results, academic progress and tuition fee payments.

Further on, the file became more personal. The university also records information from the selection process, login and update times in the OSIRIS student administration system, and reports or notes from mentors and study advisers. The medical information surprised me most. The system contained specific details about my health, hospital appointments and absences, along with a medical screenshot that I had once sent in myself as evidence of my repeated absences. The image had therefore been part of my student file for three years.

According to Domingus, notes from study advisers are held in the system from which the data is collected automatically. Different rules apply to information about conversations with, for example, a confidential counsellor or psychologist. “We cannot simply access that information either.”

Student and staff member

The overview was extensive, but was it complete? “A large part of the data collection is now automated. That saves work and is also better for privacy, because fewer people see the data”, Domingus says. A request is forwarded to the faculty the student or staff member belongs to. Data can then be exported from the registration systems. Someone must subsequently check that the overview is complete. “At first, that was done manually.”

As well as studying medicine, I work at Erasmus Magazine. The editorial team was not asked to provide data about me, even though EM is part of the university organisation. According to Domingus, the fact that I was listed as a medical student determined how the request was handled. “You said you were a student at the Faculty of Medicine. That is what we go by.”

He doesn’t think it is appropriate to investigate in detail what else an applicant is involved in. The university must also respect the applicant’s privacy when handling an access request. “It would actually be more concerning if we knew you had other roles too.” He also points out that Erasmus MC and EUR are two different organisations, which can make it more complicated to compile a complete overview.

To receive my data as a staff member as well, I should have mentioned both roles, he says. “Applicants also need to help us a little: what are you looking for, and where can we find your data?” If data is missing, applicants can ask for it to be added, according to Domingus. “You always have the right to say afterwards: this was not complete, could you also retrieve this?”

Greater awareness

Since the GDPR came into force, students and staff have in theory been better protected, says cybersecurity researcher Bernold Nieuwesteeg. “There are higher fines for failing to protect personal data properly. That should mean people are better protected. I would not want to bet on that being the case in practice.” He has, however, noticed greater awareness. “I have noticed that students have been much more aware of privacy since the GDPR than they were before.”

He is pleased about that, but says students do not need to be immediately concerned about the university’s data collection. “It is good for students to be alert to it, but the university is not aiming to hoover up your data in vast quantities as a way of making money. Its aim is to provide you with a good education, and sometimes it needs your data to do that.”

He says students would do better to look critically at other organisations that collect their data, such as social media companies. “When students download an app, much more information is stored, from location data to transaction data. They have a very different goal: they want to make money from it.” Nieuwesteeg says the purpose of collecting data is therefore very important. “The university is not trying to serve you another entertaining video so that you stay in the app for longer.”

Online data locker

Domingus would like to give students and staff direct access to the data the university processes about them. “What we ultimately want is an online data locker that you can access yourself. Then you can see what EUR processes about you.” He cannot say when that will be possible. “It would mean a lot to me. It would save a great deal of work, and we could be even more transparent with our staff and students.”