UC GDPR Gap Analysis DRAFT

	A	C	D	E	F	G	I	J	K	L	M	N	O	P	R	S	T	V	W
1		Contact Denise Dolezal with questions ddolezal@ucsc.edu
2	DRAFT-For discussion purposes only	University of California EEA GDPR Gap Analysis
3	EU GDPR concept	Law					UC Policy								Standards			Practice	comment
4		CA Information Practices Act Civil Code Sect. 1798 et seq.	FERPA	Gramm Leach Bliley Act	CMIA	HIPAA	RMP-7 Privacy of and Access to Information Responsibilities	Rules of Conduct for UC Employees Involved with Information Regarding Individuals	RMP-2 UC Records Retention & Disposition Schedule	RMP-12: Guidelines for Assuring Privacy of Personal Information in Mailing Lists and Telephone Directories	IS-3: Electronic Information Security Policy	UC Electronic Communication Policy	PACAOS	Appendix DS	NIST	ISO	Payment Card Industry Data Security Standard
5
6	Fundamental Rights of Data Subject
7	Notice: Privacy Notice (transparency)	X	X	X	X	X	X			X			X					X
8
9	Access to records relating to self - Article 15	X	X		X	X	X						X					X
10
11	Rectification/right to correction - Article 16	X	X		X	X	X						X					X
12
13	Data portability if technically feasible - Article 20				X	X												X	technical issue yet to be resolved: n/a? if legal basis is not based on consent or to facilitate contract
14
15	Erasure/Right to be forgotten - Article 17									X								X	opt-out of receiving marketing materials processes in place e.g., marketing efforts of advancement team data collection [note: must keep track of the individual and data that is disallowed to process; therefore, can one really be "erased"?]
16
17	Objection to processing personal data - Article 21			X						X								X	opt-out of receiving marketing materials processes in place e.g., marketing efforts of advancement team data collection [note: must keep track of the individual and data that is disallowed to process; therefore, can one really be "erased"?]
18
19	Controller and Processor Obligations
20	Data minimization - Article 5								X								X	X	by design some systems are not capable of deleting records w/o affecting other downstream data as SaaS and enterprise software database system vendors focus efforts to enhance functionality at expense of data deletion. Such systems have obtained a waiver of record disposition (e.g., Academic Information System (student information system) and parental Tax forms submitted in connection to student financial aid)
21
22	data breach response and notification - Article 34	X	X	*		X				X	X						X	X	* Consult OGC as the governing relationship may be contractual based on SAIG rather than GLBA
23
24	3rd party service providers - Article 28	X	X	X		X							X	X				X
25
26	privacy by design, privacy by default - Article 25	X		X		X	X	X		X		X						X
27
28	Data Inventory (record or processing) Article 30									X	X							X
29
30	Information Security - Article 32	X		X		X		X		X	X				X	X	X	X
31
32	Appoint DPO - Article 37																	X
33
34	DPIA for data processing including data transfers - Article 35																	X
35
36	Identify Lead DPA - Article 51																	!
37
38	Authenticate identity prior to providing subject records - Recitals 64 and 63	X	X	X	X	X	X				X		X					X
39
40	Cooperate with regulators									X								X
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100