TU Delft moved sensitive data of (former) students to cloud

Many universities in the Netherlands use the Osiris information system. Students use it, for example, to register for courses and exams. It also stores personal data, such as addresses, bank account numbers, and academic results.

TU Delft also uses Osiris. In November last year, the institution decided to move the data to a Dutch cloud environment. In other words, away from its own servers.

The personal data of around 267,000 (former) students and applicants were transferred as part of this process. But this also included data that should have been deleted, an investigation by university newspaper Delta found.

“Before the migration, Osiris supplier Caci BV could access student data only with TU Delft’s permission, for example in the event of a system failure. In the cloud environment, the company can independently access that data, although agreements are in place stipulating that the supplier will do so only in emergencies,” Delta writes. Caci BV is US-owned.

Unlimited retention

Under the AVG regulation for data protection, organizations are required to delete personal data “as soon as it is no longer necessary for the original purpose for which it was collected.” A university therefore cannot retain data belonging to its (former) students indefinitely.

Delta also reports that medical data was stored in Osiris. For example, students sometimes had to upload medical certificates or dyslexia documentation to request extra time for an exam. According to the university, Osiris is not intended for this purpose, but this did happen in practice.

Before the data was moved, TU Delft was warned several times to clean up the data first. However, the warnings were not acted upon. An expert told Delta that the university could be fined by the Dutch Data Protection Authority.

Tech giants

Other universities are also increasingly storing data in the cloud rather than on their own servers. This comes with another risk: by outsourcing the management of their data, universities lose some control over it. Earlier this year, universities said they wanted to become less dependent on US tech giants.

This article was translated using AI-assisted tools and reviewed by an editor.