Photo credit: Shutterstock

When Alexander “Sandy” Bilus, a cybersecurity and privacy attorney with Saul Ewing Arnstein & Lehr, was speaking to representatives from different colleges earlier this month, one of them asked if complying with the European Union's General Data Protection Regulation is worth the high cost of compliance.

The short answer is yes.

Companies and their in-house counsel around the world have been expressing concern about complying with the new regulation for months and even years. But it's easy to forget that the new rules, which took effect May 25, affect other types of institutions, including colleges and universities, in sometimes unexpected ways.

The regulation requires entities containing personal data from the EU to beef up the security of their networks and notify the public of a breach within 72 hours of discovering it, among other obligations. Penalties for noncompliance can be as high as 4 percent of revenue from the previous year or 20 million euros—whichever is greater.

“Many schools don't understand how this could impact them,” Bilus said. “The thing to remember is that the GDPR applies to the personal data of anyone who is in the EU, not just EU citizens.”

Bilus explained that those who are temporarily residents of the EU, whether they be students studying abroad for a semester or professors overseeing research, would have to have their data protected in a way that is GDPR-compliant.

And besides the significant cost of compliance, Bilus said that one problem many schools face is centralizing their data. “They'll have pockets of data all over the school,” Bilus explained. “Just understanding the scope is a big issue for schools.”

Mark McConahay, the associate vice provost and registrar at Indiana University at Bloomington, said that his general counsel began coordinating steps to become compliant roughly nine months ago and the school is still in the process of becoming fully compliant. He said the university took painstaking efforts to consider how it receives information, how it tracks that information and what information it keeps and what information it overwrites.

Speaking from an enrollment perspective, McConahay said that he had to consider all of those for European students residing in the United States, students who were studying abroad and students who were enrolled online. “Online education does apply,” McConahay said.

McConahay said that another part of the process of becoming compliant was conducting a risk assessment.

“It's more or less whether or not you have to make a full-blown change to the system,” McConahay said. “We can identify these students and treat them as exceptions.”

Bilus said that many of the schools he has spoken to and worked with have taken a wait-and-see approach just as many companies have, because it does not appear that the regulators will be targeting American universities at this juncture for noncompliance with GDPR.

“It has been my expectation that they [the regulators] are not going to put U.S.-based, nonprofit institutions at the top of the list when they want to go out and issue fines,” Bilus said.

Bilus said that many schools, like Indiana University, are still working to come into full compliance and while it may be a lengthy and expensive process, the positive is that it gives institutions of higher learning a chance for self-reflection on their own data security.

“There are a lot of good reasons to comply with GDPR. Things can change and there can be risks. If nothing else this gives people at the school the ability to say to higher ups, 'Look at what we can face. Let's use this as an opportunity so that we can better protect ourselves,'” Bilus said.