Statement of Privacy Practices
The George Washington University (“GW”) collects, stores, uses, shares, transfers and safeguards personal information in support of our academic and research mission.
We are committed to protecting your privacy and processing your personal information in compliance with applicable privacy laws and regulations.
This Statement of Privacy Practices applies to activities conducted by GW and it is meant to provide an overview of our privacy practices with regard to your personal information.
Our Website Privacy Notice supplements this Statement of Privacy Practices.
By providing your personal information to GW, you are consenting to our collection and use of information in accordance with this Statement of Privacy Practices and our policies, for GW’s legitimate business purposes or as needed to provide services you request from us.
As required by the Personal Information Protection Law of the People's Republic of China, a translation of this Statement of Privacy Practices in Chinese is available here.
Personal Information, also known as personally identifiable information or personal data, is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal information. Information that does not identify a person and cannot reasonably be used to identify a person is not personal information.
GW collects Personal Information in the following circumstances:
- Information that is automatically collected when you interact with a GW website (see our Website Privacy Notice for further details).
- Information you provide directly to us, for example through an application for admission or employment or use of university systems.
- Information gathered from other sources (e.g. transcripts provided by other educational institutions or reference letters from former employers).
GW relies on various legal basis to collect, store, use, and share your Personal Information, including:
- Legitimate interest. GW may collect and process your Personal Information for legitimate interest. For example to be able to provide you with the services you requested or to carry out our educational and operational activities.
- Contract. GW may need your Personal Information for the performance of a contract to which you are a party or in order to take steps at your request to entering into a contract.
- Legal. GW may have an obligation to use or share your Personal Information when required under federal, state or local laws or judicial orders. For example to comply with state and federal obligations or subpoenas.
- Public Interest. GW may use or share your Personal Information when necessary to respond to sudden public health incidents or to protect individuals’ lives and health, or the security of their property, under emergency conditions.
- Consent. You may have consented to the collection and use of your Personal Information. For example, when we send you electronic communications or for the use of certain cookies. In addition, when required under applicable privacy laws or for research purposes, consent would be obtained for the collection and use of Personal Information. Under certain circumstances, you may withdraw your consent by contacting us as described in the “Contact us” section of this statement.
The following sections include information regarding data collection and use for specific university purposes.
- Prospective Students
GW collects information related to prospective students in order to provide prospective students with information related to educational opportunities, to process applications, and determine eligibility for financial aid. The information provided in your application will be available to university staff and admission reviewers.
The application requires that you provide information such as your name and contact information, educational and employment history, recommendations, test scores where applicable and other materials needed to assess your application.
If you are applying for financial aid, you will be asked to provide financial information such as tax ID number, wages, scholarships, and family financial resources.
Any information collected for admissions purposes is obtained either directly from you or from contracted third parties to which you provided your information and consented to it being shared. GW may use information from admissions applications for internal quality improvement and other administrative processes necessary to provide educational services.
If admitted to study at GW, your information will become part of your student record and will be subject to the Family Educational Rights and Privacy Act (FERPA, 34 CFR Part 99).
Student information may include your name, contact information (phone number, email address, home address), GWID, academic performance, interactions with GW resources, building access, immunization status, health information, documentation in support of academic accommodations, dietary needs, payment information such as credit card or banking information, tax ID numbers, participation in extracurricular activities, and any other information you provide to GW in your capacity as a student. Information you provide directly to GW with information obtained from contracted third parties will become your student record.
This record may be used to manage student academic and residential activities such as course registrations, housing assignments, dining hall access, billing and financial aid, student advising, library resource management, course evaluation and quality improvement initiatives, academic and other accommodations related to disabilities, and in other ways.
Registration in online courses may lead to collection of additional information such as information on your interactions with the online course, including online interactions with other course participants, posts to the learning community, engagement with course materials, and test and assignment scores.
International students who will be attending GW will be asked to provide information to the International Services Office, which, in its capacity as the primary administrative, programming, and advising office for the GW international community, will assist students to apply for and maintain the appropriate visa status. Information you provide, including your name, contact information, and financial resources, and your enrollment status will be shared as required with the US Department of Homeland Security.
The use and disclosure of student information is managed in compliance with the Family Educational Rights and Privacy Act (FERPA). Our practices with regard to personal information of current or former students are described in the Privacy of Student Records Policy.
- Alumni and Donors
GW collects alumni and donor information such as name, biographical information, contact information, demographics (race/ethnicity), employment and career-related information, information relating to a person’s time at GW and other academic institutions, volunteer and event registration and attendance information, gift and recognition information, publicly available financial information, and information concerning a person’s interests, activities, memberships, and affiliations.
For alumni, some of this information may be transferred from student records. You also may provide information directly to us when you interact with the GW Division of Development and Alumni Relations or other GW offices, for example, when you register to attend a GW sponsored event.
In connection with employment applications and personnel management, GW collects and uses information such as contact information, employment and educational background, salary and benefits, banking information for payroll deposits, tax and withholding information, and information related to job performance.
Additionally, GW may collect health information about employees and prospective employees, and retains this information in accordance with state and federal employment requirements for confidentiality of employee medical information. This information includes medical and immunization records that you have provided to GW.
- Research Participants
GW researchers may collect information to conduct research studies. Researchers may also collect information from other sources, with approval from an institutional review board (a research ethics board). The collection of research participants’ information is based on study consent forms as outlined on the GW Office of Human Research website.
Information collected for research purposes commonly includes name, contact information, interview and survey responses and health information. The information collected for research purposes is retained through the research project period. In some cases, the information may be retained indefinitely and archived for public interest, scientific or historical research or statistical purposes.
For further information on collection and use of your data as a research participant, contact the GW Office of Human Research.
- Visiting Scholars
To facilitate and manage scholarly visits to GW, we may collect identification, contact information, biographic information, and possibly health information as relevant for the purpose of the visit.
- Campus Visitors and Participants in GW Sponsored Events
To facilitate visits and participation to GW events, we may collect identification, contact information, payment information, and possibly health information as relevant for the purpose of the event.
- Clients of GW Academic Clinics
GW operates various academic training clinics where graduate-level students work under faculty supervision. These clinics offer free or low-cost services to community members in the greater Washington, D.C., metropolitan area. In connection with these academic clinic operations, we collect information such as identification, contact information, health information and payment information.
GW is not considered a Covered Entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as the GW health-related clinics do not electronically bill clients’ insurance. However, while the personal and health information provided to our health-related clinics is not subject to HIPAA’s privacy and security rules, these safeguards are applied by our clinics to maintain its confidentiality.
- GW Website visitors
- Use of GW Technology Resources
GW automatically collects certain information when you use GW technology resources, including, but not limited to use of GW wireless network and applications, as well as facilities access information.
- Support secure operations of the educational, research and administrative needs of the GW community;
- Improve service reliability and security by identifying and mitigating threats and cyber attacks;
- Respond to queries and request concerning suspicious network activity, email messages and other potentially malicious actions;
- Comply with GW policies and legal obligations, in a secure online environment;
- Prevent, investigate, and take actions regarding possible fraud, unlawful or criminal activity, other misconduct, security or technical issues, or unauthorized access to or use of personal information, our website or data systems.
- Campus Security and Access Control
GW collects information such as your name and photograph for issuing your GW ID card and facilities access control.
GW also collects images from GW’s security closed circuit television (CCTV). The use of television monitoring and recording activities is restricted to common areas or highly sensitive areas where increased security is needed in GW-owned, controlled or leased property where there is no reasonable expectation of privacy.
GW collects information through the CCTV system for various reasons:
- to control access to university buildings, to ensure the security of university facilities, the safety of GW students, faculty, staff and visitors, as well as the security of property and information located or stored on the premises;
- to prevent, deter, and if necessary, investigate unauthorized physical access, including unauthorized access to student rooms, IT infrastructure, or operational information;
- to prevent, detect and investigate theft of equipment or assets owned by the University, or students.
- CCTV may also be used as an investigatory technique under certain circumstances in the private office of a faculty/staff member, with concurrence from the Office of General Counsel (OGC).
In exceptional situations, information collected via CCTV may be used for internal investigations or shared with local authorities, as part of criminal investigations.
- Institutional Research
The Office of Institutional Research & Planning (IRP) conducts advanced data analysis and research for supporting University decision-makers in developing plans to achieve University goals and objectives. IRP analyzes and interprets a wide variety of institutional and external data, to assess institutional outcomes and performance towards strategic planning goals and to evaluate student learning outcomes for improvement.
- Other purposes
We may also collect or use your information for other purposes, including:
- Providing newsletters, articles, service or safety alerts or announcements, event invitations, and other information that we believe may be of interest to you;
- Requesting gifts and donations;
- Completing requested transactions such as the purchase of event tickets or processing a donation;
- Analyzing your use of the GW websites and perform other market research activities, such as interest-based advertising, targeted advertising, and online behavioral advertising in order to determine the content would be of interest to you;
- Preventing, investigating and taking actions regarding possible fraud, unlawful or criminal activity, other misconduct, security or technical issues, or unauthorized access to or use of personal information, our website or data systems;
- Complying with legal obligations, enforce our agreements, and protect the health, safety, rights or property of you, us or others; and meeting legal obligations;
- Notifying you of an emergency or crisis that may affect you and/or the University community or to notify your designated emergency contact(s) of an emergency or crisis that may affect you and/or the University community;
- Sending you periodic communications, via SMS/Text, with educational (e.g. academic advising), employment, transactional, or general information related to the George Washington University. If you no longer wish to receive such SMS/Text communications from GW, you have the option to opt-out.
Information collected by GW will be primarily stored in the United States and will be transferred to the US if collected internationally. As allowed by applicable privacy laws and under contracted service agreements with appropriate safeguards in place, we may transfer the information to other countries for storage on our service providers’ cloud servers.
GW may share your information with our contracted third-party service providers to provide services for GW or to support GW’s activities. Examples of activities may include online course support for students, benefit services for employees, or study abroad and international studies / teaching opportunities. We require our service providers to keep your information secure through approved contract terms and conditions. GW’s contracted third-party service providers are not authorized to disclose information except as necessary to perform the services on GW’s behalf or to comply with legal requirements.
Your information may also be shared in legal proceedings, as required by law, or to protect the health and safety of you or others. We may also share your personal information internally, with various university offices, as necessary or appropriate in the conduct of legitimate university business and consistent with applicable laws.
GW does not sell or rent your personal information, neither directly nor through our contracted third parties.
GW recognizes the importance of maintaining the privacy and security of the information in our custody and has adopted generally accepted industry standards and security measures to protect against unauthorized access, alteration, disclosure, or destruction of your personal information.
These measures include but are not limited to ongoing user education, implementing identity and access management and data loss prevention solutions, deploying tools to minimize the impacts of malware, phishing, and hacking attempts, and monitoring activity to identify potential system threats. GW routinely assesses and enhances tools and processes available to strengthen the security of the information we collect and process.
You have the right to know what sort of information GW collects about you and how that information is used. You also have the option not to provide information to GW, but should be aware that this may result in the inability of the university to provide services you request from us or are required for legitimate business purposes.
Individuals located in certain countries, such as countries in the European Union (EU Residents), in Switzerland, United Kingdom or in the People’s Republic of China, are granted additional rights with respect to their personal information, under applicable privacy laws and regulations such as the EU General Data Protection Regulation, the Swiss Federal Act on Data Protection, the UK General Data Protection Regulation, China’s Personal Information Protection Law.
These additional rights may include: (i) the right to request access to your information; (ii) the right to have inaccurate or incomplete personal data rectified; (iii) the right to erasure of your information, provided there is no legitimate reason to continue to process or retain the information; (iv) the right to restrict processing of your information in specific situations; (v) the right to object to processing of your information, including to send you communications that may be considered direct-marketing materials; and (vi) the right to object to automated decision-making or profiling, where applicable.
If you wish to exercise these rights, please contact us via the Data Subject Access Request Form, or by contacting the GW Privacy Office directly. You also have the right to lodge complaints with your national or regional data protection authority.
Note that applicable laws contain certain exceptions and limitations to each of these rights. If we do not grant your request, we will explain the reason for doing so. We will also need to verify your identity before you exercise these rights, to ensure that your Personal Information is not inappropriately disclosed.
Upon a request to erase information, GW will maintain a core set of personal information to ensure we do not contact you inadvertently in the future, as well as any information necessary for archival or other legal purposes. We may also retain financial information for legal purposes, including compliance with United States Internal Revenue Service requirements. Additionally, in the event of an actual or threatened legal claim, GW may retain your information for purposes of establishing, defending against, or exercising your rights with respect to such claim.
By providing information directly to GW, you consent to the transfer of your personal information outside of your country/region to the United States. The transfer of your personal information to the US will be performed in compliance with applicable laws regarding the protection of Personal Information.
If you have questions regarding this statement or to request assistance with privacy matters, email the GW Privacy Office.
You may also use the following web-forms to report privacy concerns, potential data incidents or to exercise your privacy rights, under applicable privacy laws.
GW may modify this statement from time to time in its sole discretion. We recommend you read this statement periodically.
Published: January 2023