How to Make a Data Subject Access Request

The New School provides Data Subjects with certain rights with respect to their Personal Data. These rights apply to all members of the university community, regardless of where they live or where they were physically located when the data was collected. The New School's privacy notices provide more information about the types of Personal Data the university collects and uses.

The rights The New School provides to individuals for their Personal Data include:

• The right of access
• The right to rectification (to have inaccuracies corrected)
• The right to erasure (also known as the right to be forgotten)
• The right to restriction of processing
• The right to data portability (to transfer the data to another party)
• The right to object

All of these rights are subject to certain exemptions and limitations. More information on each right can be found in the sections below or by clicking the individual links above.

Exercising your rights

You exercise your Personal Data rights by making a Data Subject Access Request (DSAR). For your convenience, The New School provides an online form to help you begin your request. The form also grants you access to our secure privacy portal, which we will use to communicate with you about your request and provide you with the data you have requested (if applicable).

Before you complete the form however, we recommend reading about the specific right you'd like to exercise in the sections below (you can go directly to the right section by clicking on the links in the list above). There you'll find more information about what the right means, and the additional details we'll need you to provide so we can fulfill your request. In some cases, we also provide links to self-service systems you may be able to use to accomplish your request immediately.

Once you've submitted your request through the online form, we must verify your identity before we can act on your request. This step is conducted through our secure privacy portal, since it may involve the exchange of sensitive information such as a copy of your driver's license, passport, or other identity documentation. You are given access to the portal as part of completing the DSAR online form.

Upon receipt of your completed request, verification of your identity, and sufficient details to enable us to locate the information, The New School will provide you with information on our actions on your request within one month. That period may be extended where necessary, taking into account the complexity and number of the requests.

If we determine not to fulfill your request, we are required to notify you within one month of our reasons for not doing so.

As provided by applicable data protection laws, if a person’s data requests are clearly unfounded or excessive, we may charge a reasonable fee taking into account the administrative costs or decline to act on the requests.

More about your rights

The sections below provide more detailed information about each of your rights with respect to your Personal Data.

The right of access

The right of access entitles you to confirm whether The New School is Processing Personal Data about you and, if so, to obtain a copy of the data. This right is subject to limitations, including that providing a copy will not adversely affect the rights and freedoms of others.

Self-service. You may currently have access to much of this information through your MyNewSchool account (students, alumni) and/or your MyDay account (employees).

Details we will ask for. To fulfill an access request from you, we will ask you to provide as much of the following information as possible to help us locate your information:

• Your full name
• Other name(s) by which you have been known
• Your student or employee identification number (N-number)
• Your relationship(s) to the university
• Description (scope) of the Personal Data you are seeking to access
• The offices, departments, databases, or systems you believe may be Processing this information
• The dates or time periods when you believe The New School received this information

Submit an access request

The right to rectification

The right to rectification entitles you to ask us to correct inaccurate Personal Data we may have about you. In some circumstances, it may also entitle you to ask us to complete incomplete Personal Data, including by means of providing a supplementary statement.

Self-service. In many cases, The New School provides a procedure for you to update or correct your Personal Data directly, or to request a correction. Students may update or correct their address and phone number through MyNewSchool. Other updates and corrections, such as change of legal or preferred name or correction of Social Security Number and date of birth, can be handled through the Office of the Registrar. For faculty and staff, updates to contact information, personal information emergency contacts, legal name, and preferred name can be made through MyDay.

Details we will ask for. To fulfill a rectification request from you, we will ask you to provide as much of the following information as possible to help us locate and update your information:

• Your full name
• Other name(s) by which you have been known
• Your student or employee identification number (N-number)
• Your relationship(s) to the university
• The offices, departments, databases, or systems you believe may be Processing this information
• Current incorrect or incomplete information
• Corrected or complete information
• The reasons for making this request

Submit a rectification request

The right to erasure

The right to erasure enables you to request that your Personal Data be erased. This right is not absolute; it generally only applies when:

1. the Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise Processed;
2. you have withdrawn your consent to Process the Personal Data and there is no other Legal Basis for the Processing;
3. you have objected to the Processing (see below) and there is no overriding Legal Basis for the Processing;
4. your Personal Data has been unlawfully Processed; or
5. the Personal Data must be erased for compliance with a legal obligation to which the university is subject.

The New School is entitled to keep, maintain, and Process Personal Data in order to satisfy its legitimate interests, comply with legal obligations, and perform any contracts it may have with you.

Details we will ask for. To fulfill an erasure request from you, we will ask you to provide as much of the following information as possible to help us locate your information:

• Your full name
• Other name(s) by which you have been known
• Your student or employee identification number (N-number)
• Your relationship(s) to the university
• Description (scope) of the Personal Data you are seeking to access
• The offices, departments, databases, or systems you believe may be Processing this information
• The dates or time periods when you believe The New School received this information
• The reasons for making this request

Submit an erasure request

The right to restriction of processing

The right to restriction of processing entitles you to restrict or suppress the Processing of your Personal Data. This is not an absolute right and only applies in certain circumstances. The most common circumstances are:

1. If you have submitted a request to update or correct your Personal Data, you may restrict Processing of the data until that request has been resolved.
2. If you have submitted an objection to Processing (see below), you may restrict Processing of the data until that request has been resolved.
3. If the Processing of the Personal Data is unlawful, you may request that Processing be restricted in lieu of requesting that the data be erased.
4. If you have submitted a request to erase your Personal Data because it is no longer necessary in relation to the purposes for which it was collected or otherwise Processed, but the university has refused because it is required to maintain the data for the establishment, exercise, or defense of legal claims, you may request that Processing of the data be restricted.

If Processing is restricted, The New School will not be permitted to use the data without your consent, unless in connection with a legal claim, the protection of another person, or certain other exceptions. The New School would be permitted to continue to store the information.

Details we will ask for. To fulfill a resitrction of processing request from you, we will ask you to provide as much of the following information as possible to help us locate your information:

• Your full name
• Other name(s) by which you have been known
• Your student or employee identification number (N-number)
• Your relationship(s) to the university
• Description (scope) of the Personal Data you are seeking to access
• The offices, departments, databases, or systems you believe may be Processing this information
• The dates or time periods when you believe The New School received this information
• The reasons for making this request

Submit a restriction of processing request

The right to data portability

The right to data portability entitles you to obtain an electronic copy of your Personal Data to enable you to reuse that data for your own purposes across different services. This right allows you to move, copy, or transfer your Personal Data easily from one IT environment to another. This right only applies to information you have provided to The New School and depending on the context, applies to some of your information, but not to all of your information.

Self-service. In many cases, you may obtain an electronic copy of your Personal Data directly by downloading your information through your account on a New School system. A common request is for copies of individuals’ GMail or Google Drive data; this information can be downloaded through the Google Takeout service.

Note

University business information stored in employees' New School GMail and Google Drive accounts and on other administrative computer systems (both those operated locally and those hosted by a third party) is the property of The New School and may not be downloaded for any reason other than official university business.

To request an official transcript, log into your MyNewSchool account and select the Academics tab. Options to obtain copies of grades and transcripts can be found in the Registration Information section.

Details we will ask for. To fulfill a data portability request from you, we will ask you to provide as much of the following information as possible to help us locate your information:

• Your full name
• Other name(s) by which you have been known
• Your student or employee identification number (N-number)
• Your relationship(s) to the university
• Description (scope) of the Personal Data you are seeking to access
• The offices, departments, databases, or systems you believe may be Processing this information
• The dates or time periods when you believe The New School received this information
• The reasons for making this request

Submit a data portability request

The right to object

The right to object to processing entitles you, in certain circumstances, to halt the Processing of your Personal Data in the absence of a compelling reason for the Processing to continue.

Note

You have an absolute right to halt the use of your Personal Data for direct marketing purposes.

Self-service. If the reason for your request is to stop the use of your Personal Data for direct marketing purposes, you may use the “unsubscribe” links provided in all direct marketing communications from The New School to opt out of further communications.

Details we will ask for. To fulfill a data portability request from you, we will ask you to provide as much of the following information as possible to help us locate your information:

• Your full name
• Other name(s) by which you have been known
• Your student or employee identification number (N-number)
• Your relationship(s) to the university
• Description (scope) of the Personal Data you are seeking to access
• The offices, departments, databases, or systems you believe may be Processing this information
• The dates or time periods when you believe The New School received this information
• The reasons you are objecting to the Processing of this data

Submit an objection to processing

Further assistance

If you have questions about a Data Subject Access Request you have submitted, please use the secure privacy portal to communicate your question to us. This will ensure that any confidential information exchanged in the communication is not inadvertently disclosed.

For general questions about and assistance with the DSAR process or the information on this page, please contact the Information Security and Privacy Office at privacyoffice@newschool.edu.

Document history

Date	Author	Description
Oct 2020	D. Curry	Initial publication

Parts of this guideline are adapted from Tufts University’s How to Make a Subject Access request under the GDPR and its associated request form, the contents of which are used with permission.