The University of Oulu uses the Zoom Hybrid service provided through CSC and NORDUnet. It differs from the commercial cloud service purchased directly from Zoom in terms of its technical implementation and personal data processing arrangements. The service combines NORDUnet’s server environment with Zoom’s cloud services.
The University of Oulu’s general privacy notice (oulu.fi) contains the following sections applicable to the Zoom service:
- Data controller and contact details
- Legal bases for processing personal data for different user groups
- Rights of the data subject
- General procedures for processing personal data.
The University of Oulu is the data controller for personal data processed in the Zoom service. The University’s Data Protection Officer can be contacted at dpo@oulu.fi.
Further information about the Zoom service:
Why is personal data processed?
The University of Oulu uses Zoom for teaching, online courses, meetings, research collaboration, webinars and information sessions. Personal data is processed to carry out these activities, identify users, ensure information security and provide user support. The legal basis for processing personal data depends on the purpose of use and the user group. At the University of Oulu, processing is typically based on compliance with a legal obligation or the performance of a task carried out in the public interest.
What personal data is processed in Zoom?
Zoom may process names, email addresses and other user information, as well as information about meeting participation. Technical data, such as IP addresses, device information and log data, is also processed. Depending on how the meeting is conducted, the data processed may also include audio, video, chat messages, shared files, recordings, captions, transcripts and AI-generated summaries
Where is personal data obtained from?
Personal data is obtained from users themselves, the University of Oulu’s user management and authentication systems, the meeting organiser, and technical data, log data and metadata generated automatically through the use of the Zoom service and related systems.
Who processes the data and where?
In addition to the University of Oulu, the Zoom service is provided by contracted service providers and personal data processors, such as CSC, NORDUnet and Zoom Video Communications Inc., and their approved subprocessors. User account information and meeting metadata are stored in the EU, and meeting media is primarily routed through NORDUnet’s servers. Zoom Video Communications Inc. may process necessary log and support data in the United States in accordance with the EU–US Data Privacy Framework.
Recording, captioning and AI features
Recording, captioning, transcription or AI features may be used in a meeting. Recording or AI features may process, for example, participants’ audio, video, text generated from speech and chat messages.
The meeting organiser decides whether to use recording, captioning, transcription and AI features.
Participants are notified in Zoom when meeting recording or AI features are activated.
The Zoom service does not carry out automated decision-making affecting individuals or profiling.
Data retention in Zoom
Personal data is retained only for as long as necessary for its intended purpose, in accordance with the University of Oulu’s information management plan and other specified retention periods. Zoom cloud recordings, captions, and log and reporting data are deleted in accordance with their specified retention periods. As a rule, data processed in a meeting is deleted after 30 days. A cloud recording of a meeting may be created temporarily in the Zoom environment before being transferred to the Panopto system used by the University of Oulu. Long-term retention of the recording takes place in Panopto in accordance with its own retention and access rights policies. User account information and meeting metadata are stored in European data centres.
Private Mode
In Private Mode, meeting signalling and media remain within NORDUnet’s research and education network environment, and meeting media is not routed through Zoom’s cloud service. Not all features that rely on Zoom’s cloud service, such as some recording and AI features, are available in Private Mode.