Last updated June 14, 2024
Law School Admission Council, Inc. and its affiliates (collectively, “LSAC,” “we,” “our” or “us”) are committed to privacy and to transparency in our information practices. In this European Economic Area (“EEA”) and United Kingdom (“UK”) General Data Protection Regulation (“GDPR”) Privacy Notice Supplement (“GDPR Supplement”), we provide additional notices to supplement the information in the LSAC Privacy Notice. This GDPR Supplement is subject to the LSAC Privacy Notice and is incorporated by reference as a supplement thereto.
To fully understand how we collect, use, disclose, and process your Personal Information (as defined in the LSAC Privacy Notice) that we collect in relation to our Services, this GDPR Supplement should be read in conjunction with the LSAC Privacy Notice. Capitalized terms used in this GDPR Supplement, which are not otherwise defined, have the meanings assigned to them in the LSAC Privacy Notice.
Your Rights
If you are in the EEA or the UK, you have certain rights and protections under the law regarding the processing of your Personal Information.
Subject to certain limitations and exceptions, you have the following legal rights:
- A right to obtain information: You have the right to request information about how your Personal Information is processed.
- A right of access: You have the right to request access to, or a copy of, your Personal Information.
- A right of rectification: You have the right to request correction or supplementation of inaccurate or incomplete Personal Information.
- A right of erasure: You have the right to request deletion of your Personal Information.
- A right to restriction of processing: You have the right to request restriction of processing of your Personal Information, so that such data may be stored but not further processed.
- A right to data portability: You have the right to request your Personal Information in a structured, commonly used, and machine-readable format, and you have the right to transmit such data to another controller without hindrance.
- A right to object to processing: You have the right to request the cessation of processing your Personal Information (for example, when your Personal Information is processed for direct marketing purposes, you have the right to object to the processing of such data at any time).
- A right to revoke your consent: When processing is based on your consent, you have the right to revoke such consent at any time.
- The right to file a complaint: You have the right to file a complaint regarding data protection practices with a supervisory authority. If you are located in the EEA, contact details for your supervisory authority are available with the European Data Protection Board (EDPB)
. If you are located in the UK, contact details for your supervisory authority are available with the Information Commissioner’s Office (ICO)
To submit a request to exercise these rights, complete the Data Privacy Request form .
Legal Bases for our Processing
Our processing of Personal Information, as described in the LSAC Privacy Notice, is based on the following legal bases:
- When we process your Personal Information to provide requested Services, our processing is based on our legitimate interest in providing the requested Services, or, if you are a party to a contract with us or have requested to enter into a contract with us, our processing may be based on the necessity to perform or enter into such contract.
- When we process your Personal Information to maintain and customize your account and our interactions with you; send you technical notices, updates, security alerts, and support and administrative messages; respond to your comments, questions, and customer service requests; monitor and analyze trends, usage, and activities in connection with our Services; generate aggregate statistical studies to use internally or to provide to schools and other eligible programs related to legal education; conduct research ourselves or jointly with others related to our Services and the use of our Websites; conduct research, training, and other internal work to maintain, improve, repair, or develop our Services, workforce, or technology, our processing is based on our legitimate interests in maintaining the quality and security of our Services, providing you with a good user experience, and better understanding user needs and expectations, and preventing fraud and securing our Services.
- When we process your Personal Information to comply with applicable legal requirements; investigate, exercise, prepare for, or defend actual or anticipated legal claims; comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by governmental authorities; cooperate with law enforcement agencies concerning conduct or activities that we reasonably and in good faith believe may violate applicable law; prevent, detect, investigate, protect against, or respond to possible misconduct or irregularities on the LSAT or in the law school admission process, security incidents, identity theft, fraud, harassment, or malicious, deceptive, or illegal activity; protect the rights and property of LSAC and others; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action, our processing is based on our legitimate interests in complying with our legal obligations; preventing and addressing illegal conduct; protecting you, LSAC, and/or others; and maintaining the quality and security of our Services.
- When we process your Personal Information to develop and send marketing communications about products, services, offers, and events offered by LSAC and others; provide news and information we think will be of interest to you; or inform you of our philanthropic endeavors and opportunities, our processing is based on our legitimate interest in providing information about products, services, and opportunities that may be of interest to you, unless applicable law requires us to obtain your consent, in which case we will do so. You may opt-out of receiving such communications at any time (see the Opting out of LSAC Promotional Communications section of the LSAC Privacy Notice for details).
- When we process your sensitive Personal Information (i.e., types of Personal Information described under GDPR Article 9), our processing is based on your consent. Generally, you may withdraw your consent by modifying your account settings in relation to the Service(s) for which we process your sensitive Personal Information (see the Your Choices section of the LSAC Privacy Notice for details. You may also withdraw your consent at any time by completing the Data Privacy Request form
- When we share your Personal Information with law schools, including schools you did not apply to, and legal education support programs, in order to further their research, development, and marketing initiatives, our processing is based on your consent. You may withdraw your consent at any time by following the instructions described in the Opting out of JD Online account, CRS, and CAS Data Sharing section of the LSAC Privacy Notice.
- When we process your Personal Information from Cookies to remember your online settings and preferences; learn about how you interact with our Services and help us improve them; obtain online user analytics to help us understand and improve our Services; or deliver advertisements, make advertisements more relevant and meaningful, and track the efficiency of our advertising campaigns both on our Services and on other websites, our processing is based on your consent. You may withdraw your consent at any time by reviewing your cookie consent settings.
- When we process your Personal Information as an emergency contact for someone using our Services, our processing is based on our legitimate interest in responding to emergencies, and in some cases, our processing may be based on the need to protect an individual’s vital interests.