Data Protection

Personal Data

Personal data is any information that directly identifies (name, surname, email address, etc.) or indirectly (phone number, IP address, etc.) a person.

Personal Data Processing

A personal data processing is an operation (or several operations) made on personal data. This ranges from simple data collection to transformation or dissemination.

Managing tuition data, implement a survey, update a contact database, sharing personal data on a website or to a third party are examples of personal data processing, as for the law.

Data Controller

A data controller implements data processing by committing to its right compliance with the law.

Right to be Informed

Any processing of personal data must be lawful and fair. Information on the processing of these data must be easily accessible and formulated in such a way that it makes easier understanding.

Consent

When needed, the consent must be given by voluntary, clear and free act by the data subject who agrees in a specific, informed and unequivocal way to the processing of its personal data.

Exercise of Rights

Protect Your Digital Privacy

• Computers, mobile phones, tablets, etc. : same fight !
  1. Encrypt your equipment (Learn more about encryption on the CNIL website)
  2. Accept updates (antivirus, firewall, OS, applications)
  3. Do not connect suspicious removable devices to your devices
  4. Put on stand by your equipment in case of absence
  5. Always disconnect from public computers
• Set your privacy options and regularly delete your tracks (cookies and history in all your browsers, all your digital mail and all your computer equipment)
• Make sure the HTTPS (and the lock for my transactions), and avoid open WIFI
• Cyberviolences and cyberbullying, are offenses under the Penal Code.
  
• In order to get to know your right to monitor your personal data, read all the advices of the French Data Protection Authority (the CNIL).
• For gender-based or sexual violences, find support with the external support service run by France Victimes, implemented by Sciences Po

Protect Your Digital Student Life

• Your password is in good hands: yours
  1. Separate your Sciences Po password from passwords used in your private life and choose one for each digital account
  2. Never write your password and never share it with anyone
  3. Never save your passwords in your browser
• Use your Sciences Po account firstname.lastname@sciencespo.fr to exchange with the administration
• Do not collect or disseminate the personal data of other students, teachers or staff without their consent
• Respect and obtain copyright and image rights before reuse of content found on the web
• Anonymize your surveys or comply with the GDPR obligations

Use GDPR Legal models when working on academic questionnaires

When working on academic questionnaires/surveys, you need to learn how to inform and obtain consent of participants, and to comply with the European data protection legal standards.

You are invited to contact your DPO at dpo@sciencespo.fr to be accompanied in your compliance procedures.

Register Personal Data Processing

If you process personal data at Sciences Po, at the request of your teachers or as part of your student life (for example: setting up a project, micro-research in the humanities and social sciences with surveys or interviews) and the treatments must be brought into compliance, contact the DPO department at dpo@sciencespo.fr.

Your Data Protection Officer may contact you or your teacher to accompany you.

Check if your treatment is particularly sensitive

The implementation of new data processing requires questioning the possibility to "generate a high risk" for the data subjects.

Evaluate the risks raised by your data processing using the document "Is a risk analysis necessary?" (GDoc on authentication).

Your data processing is sensitive: you must carry out a data protection impact analysis (DPIA)

Within the frame of academic works, when the processing of personal data, taking into account its nature, scope, context and purposes, is likely to generate a high risk for the rights and freedoms of natural persons, it is expected that the students write, before processing, an analysis of the impact of the data processing operations on data subjects, and share it to their teachers.

Use the Data Protection Impact Analysis (AIPD) model (GDoc on authentication, FR).

Notify Sciences Po of a Data Breach

If you think you are a victim of hacking, renew the compromised identifiers and report the incident to the people or organizations concerned (your institution, bank, tax center, Internet access provider, etc.).

In case of data breach, immediately contact dpo@sciencespo.fr and sos@sciencespo.fr.