I.    Purpose and Scope

Northeastern University and its subsidiaries and affiliates (collectively “Northeastern” or “the university”) are committed to protecting the privacy of the personal information of our (i) current and former employees, (ii) workers, contractors, co-ops, interns and volunteers, (iii) visiting and guest lecturers, (iv) applicants for any of the preceding and (v) board members and honorary position holders (collectively referred to as “individuals”) that the university collects, uses, stores, creates and shares (collectively referred to as “processing”) in connection with employment or other work with Northeastern.  This policy provides information on how the university endeavors to fulfill that commitment.

The university may update this policy from time to time for different reasons, including to accommodate changing operational practices and legal requirements.  The most up to date version of this policy will be available on the University Policies website (https://policies.northeastern.edu).  If there is an important change that the university wants to highlight, the university will notify individuals in another appropriate way (such as via a pop-up notice or a statement of changes on the Employee Hub).

II.  Definitions

Personal Information

As used in this policy, “personal information” means all information that relates to an identified or identifiable individual.  For example, an individual’s name, address, email address, educational and employment background, compensation, benefits, dependent information and performance details are all examples of personal information.  Personal information is also information related to an individual’s access to and use of Northeastern facilities or systems.

III.   Policy

          A.  Types of Personal Information the University Processes and Collects

Northeastern processes personal information that individuals provide directly to the university and to the university’s third-party  services providers, such as via forms submitted to local HR representative or online in Workday.

The university may also process personal information collected from other sources such as its third-party service providers and partners.  This may include information collected in connection with background or employment checks or in the context of investigations; information provided by insurance, payroll or retirement benefits providers; and information provided as part of training and career development.

The university may process the following types of personal information in connection with an individual’s work at Northeastern:

1. Name, date of birth, government identifier and other legally required information and documentation necessary for employment purposes.
2. Personal contact details such as email address, personal telephone or mobile number, home address and other contact details (including emergency contact).
3. Health, family information, lifestyle and social circumstances, including health plans, medical conditions and treatment, marital status, nationality, number of children, and name(s) and health and other information about spouse and children.
4. Employment details, such as employing entity name, location, job title and function; employment history, salary and other benefits; job performance, accommodations, leaves of absence and time off; training records, professional membership and other capabilities (such as language proficiency); government-issued and Northeastern identification numbers, and social security details.
5. Information related to an individual’s use of Northeastern systems and facilities, such as communications, log data, device information, CCTV footage and photographs, carrier-related information, usage information and location.
6. Education/qualification, CVs and resumes, references, right to work documentation, and results from background checks and other information an individual may provide as part of the work application process.
7. Administrative, audit, accounting, financial and immigration information, including tax information, bank account information, insurance beneficiaries, and passport details.
8. Photographs, including printed on an individual’s access badge, stored in security systems and uploaded into an individual’s Workday profile.
9. Information gathered in connection with system and network monitoring and investigations, such as video footage and ID badge records; network, computer, email, phone and other communications or messaging systems; logs, data and files, including network traffic data and domain names of websites visited; files and files stored in Northeastern workspaces; imaging and forensic analysis of computing resources and any data stored on those resources.
10. Disciplinary information, including information related to the investigation, adjudication and determination or outcome of any alleged violation of law or Northeastern policy.
11. Call and meeting recording data, including from internal or external telephone or virtual meetings and other web-based technologies which may include both audio, video and text recordings and transcripts.
12. Special or sensitive information such as marriage/partnership, race, religion, disability, health, gender or sexual identity, criminal history, or political affiliation.
13. Data relevant to performing due diligence in connection with, or to facilitate in the orderly transition in the event of, a transaction such as a merger or acquisition, partnership or transfer of any Northeastern or another entity’s assets.

B.  How the University Uses Personal Information

Northeastern uses an individual’s personal information for purposes consistent with this policy and any other purposes specified at the time of collection, except as otherwise authorized or required by law.  The table below includes specific uses for which the university may use an individual’s personal information (as well as the legal bases for employees based in the UK or EEA):

C. When Personal Information May Be Shared

     1.     Sharing Within Northeastern

As a global university, an individual’s personal information may be shared within Northeastern’s global organization, including to other Northeastern entities outside the country in which the individual resides.  The following is a list of Northeastern entities, their registered addresses and contact details:

Northeastern University
360 Huntington Avenue
Boston, MA 02115 USA
1-617-373-2000

KRI at Northeastern University, LLC
141 South Bedford Street
Burlington, MA 01803 USA
1-781-238-8440

Northeastern University – London
Devon House, 58 St Katharine’s Way
London, E1W 1LP, United Kingdom
44-(0)20 7637 4550

The categories of recipients of personal information within Northeastern for the purposes set forth in Section III.B above may include the following functions:

• • HR functions such as Accommodations, Benefits, Compensation, Hiring, Investigations, Mobility, Performance Management, Terminations and Training
  • Finance functions such as Accounting and Payment Operations
  • IT functions such as Enterprise Productivity and Collaboration
  • Legal functions such as Immigration, Labor and Employment, Privacy and Litigation
  • Security functions such as Network Management, NU Police Department, and Investigations
  • Advancement functions such as Annual Giving and Events
  • Reporting functions such as University Decision Support
  • Research functions such as NU Research (but only when aggregated and/or de-identified)
  • The employee’s manager, employee’s management chain and senior leaders
  • Stakeholders involved in the employment application process

  Northeastern employees are authorized to access personal information only to the extent necessary to serve the applicable operational purpose and to perform the employees’ job functions.

   2.  Sharing with Third Parties

Where necessary, personal information may be shared with third parties in the following circumstances:

• • Third-party partners and service providers (such as those providing payroll, bank, audit, travel, benefits, legal, telecommunications, IT, background or employment verification, recruiting, training, career development, and other similar types of services) in order for those service providers to perform operational and compliance functions for or on behalf of Northeastern.
  • Public and governmental authorities and agencies when there is a legal basis for doing so, including as necessary in order to comply with applicable laws and respond to legally required requests in response to law enforcement or other government agencies.
  • Customers of Northeastern in the course of providing services, such as when customers request or require personal information about the Northeastern resources who are performing services for them under the terms of a contract.
  • Institutions or other entities in the course of engaging in research, co-ops or providing references as necessary for the coordination of such activities, including the administration of such activities as well as the record-keeping and other legal requirements of these entities.
  • To comply with applicable laws, protect the university’s rights and/or those of an individual and others, protect the safety of individuals, others and the public, and protect Northeastern against legal liability.

  When third parties are given access to an individual’s personal information, the university requires the third party (where applicable) to abide by contractual provisions designed to ensure that personal information is processed only for the purpose for which it is provided, consistent with this policy, and in accordance with applicable law.  In some cases, third parties such as certain travel or benefits and compensation providers may collect information directly from an individual and/or establish a direct relationship with the individual, in which case the terms of their privacy policies will apply.

• In addition, the names and other work-related personal information of Northeastern faculty, staff, lecturers and directors may be published on Northeastern websites.

D.  Retention of Personal Information

The university retains the personal information of individuals for as long as it is reasonable to fulfill the purposes for which the information was collected or as required for the purposes set forth in Section 3.  The university follows the retention practices set forth in the Northeastern Policy on Retention and Disposition of University Records (Retention Policy) and the Record Retention Schedule (Retention Schedule).  The retention practices followed by Northeastern University – London are set forth in the Data Protection Policy.

E.  Global Transfers of Personal Information

Northeastern is a global university with operations in many countries around the world.  As a result, personal information may be transferred to, accessed from and/or stored in the United States and other global jurisdictions where Northeastern has campuses and operations (including the jurisdictions of its service providers).  If an individual’s personal information is transferred to another Northeastern entity or to a third party in a country that does not provide the same level of protection as the country in which the individual resides, Northeastern will take measures to ensure that personal information is adequately protected and handled in a manner consistent with the terms of this policy and applicable law.

F.   Securing Personal Information

Northeastern has implemented appropriate technical, physical and organizational measures designed to protect individuals’ personal information against accidental or unlawful loss, damage, alteration, disclosure or access as well all other unlawful forms of processing and in accordance with the Northeastern Information Security Program, the Policy on Confidentiality of University Records and Information and the corresponding Data Classification Guidelines.  The university continually reviews and updates its security policies and controls as technology changes to strengthen our information security practices related to the handling of individuals’ personal information.

Access to personal information by Northeastern employees is limited on a need-to-know basis and employees accessing personal information are required to keep personal information confidential as described in the Northeastern Policy on Confidentiality of University Records and Information as well as comply with other applicable Northeastern Policies and Office of Information Security policies, standards and practices.

G.  Individual Rights

1.    Consent

Where required by applicable law, the University will ask for consent to process an individual’s personal information at the time of collection or when the university wishes to process an individual’s personal information for any additional purpose not covered in Section III.B.  If an individual decides to withdraw consent, the university will stop processing their personal information for that purpose, unless there is another lawful basis permitting university use and will inform the individual if that is the case.

Northeastern may use the personal information of individuals to provide them with promotional information such as updates and information about new programs and services, requests for financial support, upcoming events or other promotions or news, subject to applicable law.  Individuals may opt out of receiving such communications by opting out in the link provided in the communication or by emailing privacy@northeastern.edu.

2.     Accuracy

Northeastern makes reasonable efforts to maintain the accuracy of personal information.  As a general matter, an individual may update personal information in Northeastern’s Workday system (or equivalent employment management system if the individual’s campus has not yet integrated with Workday) or other self-service applications into which they have submitted and have access to their personal information.  For records not available via self-service, individuals may request a correction if there is an error or omission by submitting a request to privacy@northeastern.edu that specifies in sufficient detail the personal information at issue and the correction sought.  The university will correct the error or omission where required, and if it decides not to, will note that a correction request was requested but not made in the file.  Please refer to the Policy on Personnel Files for additional information.

        3.      Automated Decision-Making

In the event that the university uses the personal information of an individual to carry out wholly automated decision-making (including profiling) which produces legal or similarly significant effects concerning an individual, the university will inform them at the point where any such data is collected and request consent where required by law.

        4.      Other Rights

Depending on the individual’s country of residence (such as Canada or the UK) and subject to specific exceptions under applicable laws, individuals may be entitled to exercise of one or more of the following rights:

• • • • • • Access and/or take personal information
          • Delete personal information
          • Object to or restrict use of personal information
          • Withdraw consent

          The university will comply with requests in a timely manner consistent with applicable data protection law and to the extent appropriate given the purposes for which Northeastern collected and is using an individual’s personal information.  The university will facilitate the same, where possible, with third parties with whom it may have shared the individual’s personal information.  In some cases, however, Northeastern may not agree to some or all of an individual’s request if:  it is not permitted or required under applicable law or contractual obligation; continued processing is necessary for the purpose for which it was collected; processing is for public health, research or statistical purposes; the request is not consistent with the university’s legal obligations or is necessary for the defense of legal claims; or it is necessary for the performance of a contract between an individual and Northeastern.  In such cases, Northeastern will provide reasons for its refusal and the name of the person who can answer questions about the request.

      • • If there are general questions about accessing personal information or if an individual would like to exercise established rights under applicable law with respect to the individual’s personal information that is not stored in a self-service application, that individual may submit a request to privacy@northeastern.edu.
      • • When submitting a request to exercise a right under Section III.G, the individual must include:
          • The individual’s full name, email and physical address and function
          • Sufficient details to enable Northeastern to identify the records (for example, the individual’s ID# or dates of employment)
          • A description of request, in as much detail as possible, including the reason for the request

      In order to process the request, the University will need original proof of identity, and if making the request on the behalf of another individual,evidence of authorization to do so.  The university will process received requests promptly and within the timeframe required by applicable law.

      A description of request, in as much detail as possible, including the reason for the request

       

    • Additional questions about an individual’s rights can be directed to privacy@northeastern.edu.

H.        Entity Responsible for Processing Personal Information

The Northeastern entity that pays employees or collects an individual’s personal information in other non-employment contexts (referred to under some laws as the “data controller”) is responsible for the processing of employees’ personal information in accordance with this policy.  Details about this entity are included in an individual’s employment, service or other contract (if applicable) and/or in their Workday profiles (if applicable).  Northeastern University (if different from the individual’s local employment entity), registered at 360 Huntington Avenue, Boston MA 02115 USA, may also act as a data controller with respect to the processing of personal information as set forth in Section C.1.  Northeastern University – London is registered as a data controller with the UK Information Commissioner’s Office, registration number Z3136922.

IV. Additional Information

N/A

V. Contact Information

Northeastern has appointed a Chief Privacy Officer.  If there are any questions or complaints related to the handling of an individual’s personal information, including if an individual believes that said individual’s personal information has been used in a way that is not consistent with this policy, please contact privacy@northeastern.edu or write to:

Chief Privacy Officer
Northeastern University
716 Columbus Avenue
Boston, MA 02115 USA

Northeastern University – London has also appointed a Data Protection Officer, whose contact information is:
Data Protection Officer
Northeastern University – London
Devon House, 58 St. Katharine’s Way
London E1W 1LP
Dpo@nulondon.ac.uk
Chief Privacy Officer

Residents of the United Kingdom and Canada who are not satisfied with the university’s response to a request or complaint under this policy may have it reviewed by the data protection authority that is authorized to hear those concerns, which may include the UK Information Commissioner’s Office or the Privacy Commissioner of British Columbia or the Privacy Commissioner of Canada (as applicable).

Responsible Office/Department(s)

Office of the General Counsel

Related Policies

Policy on Appropriate Use of Computer and Network Resources
Policy on Data Access
Policy on the Confidentiality of University Records and Information
Policy on Personnel Files
Policy on Request for Salary and Employment Verifications
Policy on Background Checks and Credential Verifications
Policy on Retention and Disposition of University Records
Northeastern University-London Data Protection Policy

Faculty Handbook

Related Procedures

Records Retention Schedule (Requires a Northeastern Office365 Account)
Data Classification Guidelines (Requires a Northeastern Office365 Account)
Updating Personal Information (Faculty/Staff)

Supersedes

Policy 707-CAN Policy on Personal Information (to the extent it applied to employees and other workers)
Northeastern Privacy Statement (to the extent it applied to employees and other workers)
Northeastern University – London Privacy Notice for Employees, Job Applicants and Others Working at the University
Northeastern University – London Data Protection Policy (to the extent it applied to employees and other workers)

Keywords

Personal Information, privacy, collection of data, collection of information, data retention, transfer of information, sharing information

Version History

Last Revision Date: N/A

Issued: April 4, 2024