Information Security Office Menu

University of Oregon Privacy Notice

The University of Oregon (“university” or “UO”) Privacy Notice applies to university conduct or activities involving the collection, use, storage, disclosure or management of personal information including but not limited to conduct or activities described in the university’s Privacy Policy. This notice provides the minimum baseline guidance for the reasonable expectation of privacy in personal information in the absence of more specific legal, policy, or contractual requirements. It also presents a broad overview of the range of conduct or activities that require the processing of personal information and the university’s general approach to safeguarding personal information. However, schools, colleges, and departments at the UO may have additional privacy notices, practices and requirements that are related to their specific collection and practices regarding the processing of personal information. Likewise, different individuals or groups of people (e.g., students, faculty, patients, research subjects) may be entitled to heightened privacy protections by virtue of their relationship to the university and specific privacy laws and university policies.

The university values the reasonable privacy expectations of members of the university community and strives to protect the reasonable expectation of privacy by:

• Informing individuals about our information and privacy policies, procedures and practices;
• Collecting the minimum amount of personal information necessary for legitimate business purposes and legal compliance;
• Limiting access to personal information to appropriate and authorized individuals;
• Using appropriate physical and technical security measures to protect personal information, and
• Integrating privacy principles in the design of projects that involve use of personal information.

This document is for notice purposes only and it is not intended to create new or additional rights or a contractual relationship with any party or person.

Definitions

In this notice, “personal information” means any recorded information or data that is about an individual person and from which that person can be identified. It does not include information where an individual person's identity has been removed (e.g., anonymous or redacted information).

"Personal information processing” means anything that any individual acting on behalf of the university does with the personal information – including, but not limited to collection, use, storage, disclosure, conversion, migration, deletion, or retention.

Types of Personal Information We May Collect

UO may collect personal information from individuals directly, through information that individuals provide and/or automated processes (e.g., learning management tools or UO websites), or from third

party entities. Examples of personal information that might be collected for different groups of people at an institutional level include:

• Prospective Students: to facilitate admission and provide higher education services, UO collects personal and family information related to the application and financial aid process (including supporting documentation), identification and contact information, education history, demographic information (e.g., race, gender, and age) as volunteered, testing history, personal information and history, employment history, and payment information.
• Students: to register, administer financial aid, provide housing, track academic progress, and provide academic advising and other services, UO uses information submitted as prospective students, information related to academic record and performance, subscription data for online courses, and video images recorded by our video security systems for the purposes of ensuring physical security and to protect university individuals and property. The university also uses photos for photo identification and identification at the time of accessing services for validation (e.g., academic advising).
• Faculty and staff: to administer an employment relationship with the university, the university collects identification, contact information, demographic information as volunteered, access to protected environments, biographic information, employment and education history, payment and tax information, family and health information related to benefits, information related to performance at work (e.g., for health, safety, and compliance purposes) and video images recorded by our video security systems for the purposes of ensuring physical security and to protect university individuals and property. The university also uses photos for photo identification and identification at the time of accessing services for validation.
• Visiting scholars and exchange students: to facilitate their time at the university, UO may collect identification, contact information, demographic information as volunteered, biographic information, and possibly data related to health as relevant.
• Donors and Alumni: to manage their relationship and engagement with the university, the university collects identification, contact information, and donor information.
• Research subjects: in the exercise of scientific, historical research, or for statistical purposes, the university collects identification and contact information and all information that is produced and observed in relation to the subject as part of a research project.
• Participants in conferences, symposia, and other campus events: to register, track payment, and support participation, the university collects identification, contact information, payment information, demographic information as volunteered, and possibly data related to health for accommodation.
• Website visitors: to understand and save their preferences for future visits and compile aggregate data about site traffic and site interaction so that we can offer better site experiences, the university may collect IP address, browser type, internet service provider, operating system, date and time of visit, location information, pages visited, pages interactions, such as link clicks, scroll depth, and other information submitted directly via a web form or collected through or stored in web cookies.
• Campus visitors: To facilitate their visit, the university collects contact information, payment information, and video images recorded by our video security systems to ensure physical safety and security and to protect university property.

The university occasionally processes other types of personal information for various legitimate and specific purposes. When these situations occur, the university endeavors to inform covered subjects of such occasional processing activities.

How We Use Your Personal Information

UO uses the personal information it collects to facilitate and discharge administrative, educational, and research activities and operations of the university. UO only uses your personal information for the lawful and appropriate purposes for which the personal information was collected unless the university reasonably concludes that it is needed for and may be used for another legitimate reason.

Sharing Your Information with Third Parties

The university may share or disclose your personal information with third parties who contract with the university to help it operate and/or administer and discharge its obligations. The university permits third parties to process your information only for specified purposes in accordance with the UO’s instructions or contracts, and UO seeks to share necessary and pertinent information only.

UO may also share your personal information with third parties to comply with certain legal obligations, administer a contract, and/or assist university-affiliated programs regarding contacting you about goods, services, charitable giving, or experiences that may be of personal interest.

Other circumstances where the university may need to share your personal information with third parties include when the university has consent to do so or when it is necessary to protect the health and safety of you or others.

How We Secure Your Information

UO recognizes the importance of securing the information it collects and maintains. While the university cannot guarantee that information submitted over the internet is completely secure, it is committed to protecting the privacy of individuals who access our systems. The university deploys reasonable security measures, including but not limited to physical, administrative, and technical safeguards, to protect personal information.

Notice and Consent

Where required by applicable law, prior to collection of personal information, the university will make available a notice that describes the personal information that will be collected, how it will be processed, and with whom the personal information will be shared. The university will also seek individual consent when it is required by applicable law.

Exceptions to this notice and consent requirement are permitted to the extent allowed under law.

Regulations Informing Our Privacy Practices

UO’s practices are informed by various legal and regulatory requirements, university policies, and industry best practices. In addition, different groups within the university are subject to more specific privacy regulatory requirements. Below is a nonexclusive list of some of the most frequently implicated regulatory provisions impacting privacy at the UO:

• Family Educational Rights and Privacy Act (FERPA)

  • The university is required to comply with the federal Family Educational Rights and Privacy Act of 1974. The university has a policy that outlines the requirements that must be followed with regard to student education records: https://policies.uoregon.edu/student-records-1.

• Health Insurance Portability and Accountability Act (HIPAA)

  • In some cases, the university is required to comply with the Health Insurance Portability and Accountability Act. Additional information about the university’s compliance information can be found here: https://safety.uoregon.edu/university-oregon-hipaa-privacy-team.

• General Data Protection Regulation (GDPR)

  • In addition to the general privacy information above, the GDPR outlines the collection, use and disclosure of certain personal data provided to the UO. Additional information about GDPR and the university’s compliance requirements can be found here: https://service.uoregon.edu/TDClient/2030/Portal/KB/ArticleDet?ID=127175.

• Oregon Public Records Law

  • Information collected, used, disclosed and stored by the university is generally subject to the Oregon Public Records Law and therefore subject to inspection by the general public unless an applicable exemption applies. More information about the Oregon Public Records law can be found in the Oregon Attorney General Public Records and Meetings Manual and the Oregon Public Records Advocate.

Records Retention Schedule

For information on how long the university retains records, please visit the university’s Records Retention Schedule: https://rrs.uoregon.edu/.

Collection of Data about Children or Minors

The University of Oregon does not knowingly collect personal information from children or minors as defined by the Children's Online Privacy Protection Act (COPPA) on its general websites. The collection and use of personal information from children or minors for other purposes is subject to supplemental and more specific notification or consent terms.

Links to and References from Third-party Websites and Services

University websites (e.g., oregon.edu) contain links to, and may be linked from, sites outside of the University of Oregon. The university is not responsible for the privacy practices, terms of use, or the content of such platforms, websites, and services. A link to an outside platform, website, service or embed of content on uoregon.edu does not constitute an endorsement or sponsorship of the site, service, or its contents. In addition, the University of Oregon may embed content, such as video, social media feeds or tracking mechanisms such as pixels, that allow for collection of data by third parties to provide visitors with services.

Privacy Notice Changes

This privacy notice may be updated from time to time. The notice will include the date of the latest update.

Contact

If you have any questions about our practices around the use of personal information, contact privacyofficer@uoregon.edu.

Last Updated: May 5, 2025