Legal Risks in American University of Antigua College of Medicine’s Privacy Policy: A Redline Case Study | Erayaha

## When Privacy Policies Fall Short: AUA College of Medicine’s Hidden Legal Risks

Imagine a scenario where a single ambiguous clause in a university’s privacy policy leads to a $2 million GDPR fine or a costly class action under the CCPA. Our analysis of American University of Antigua College of Medicine’s (AUA) Privacy Policy uncovers four key legal and logical risks that could expose the institution to significant financial and reputational harm.

1. Ambiguous International Data Transfer Safeguards AUA’s policy states that international transfers will be protected “in accordance with this privacy policy,” but fails to specify legally required safeguards (e.g., Standard Contractual Clauses, adequacy decisions). This exposes AUA to regulatory scrutiny and potential fines of up to €20 million under GDPR for unlawful data transfers.

Legal Analysis

high Risk

Removed

Added

If we transfer your personal information to third parties in other countries: (i), we will perform thoseensure such transfers in accordance withare protected by appropriate safeguards, including the requirementsuse of applicable law; and (ii) we will protectStandard Contractual Clauses approved by the transferred personal information in accordance with this privacy policyEuropean Commission, adequacy decisions, or other legally recognized mechanisms, as required by GDPR and other applicable data protection laws.

Legal Explanation

The original clause lacks specificity regarding the safeguards required for international data transfers under GDPR and similar frameworks. The revision explicitly references recognized legal mechanisms, reducing regulatory risk and improving enforceability.

2. Overbroad Marketing Consent and DND Bypass The policy reserves the right to contact users via Call, SMS, Email, or WhatsApp about products and offers, even if the user’s number is on a Do Not Disturb (DND) list. This approach risks violating the Telephone Consumer Protection Act (TCPA) and similar laws, which can result in statutory damages of $500–$1,500 per unsolicited call or message.

Legal Analysis

critical Risk

Removed

Added

In caseIf you have submittedprovided your personal information and contact details, we reserve the rights to Call, SMS, Email or WhatsApp about our productswill only contact you for marketing purposes with your explicit consent and offersin compliance with applicable laws, even if your number has including honoring Do Not Disturb (DND activated on it) lists and opt-out requests, as required by the Telephone Consumer Protection Act (TCPA) and similar regulations.

Legal Explanation

The original clause disregards DND lists and lacks a clear consent mechanism, risking violation of TCPA and similar laws. The revision ensures compliance with consent and opt-out requirements, reducing exposure to statutory damages.

3. Vague Data Retention and Deletion Practices AUA’s data retention clause lacks specific retention periods and deletion protocols, merely stating that data will be deleted or anonymized when “no longer required.” This ambiguity may violate GDPR Article 5(1)(e) and CCPA requirements, exposing AUA to regulatory action and class-action lawsuits.

Legal Analysis

high Risk

Removed

Added

We keepretain your personal information only for as long as we need to. This timethe minimum period may depend on what we are using your information for,necessary to fulfill the purposes outlined in accordance with this privacy policy, subject to specific retention periods mandated by applicable laws and regulations (e. For exampleg., if you have provided us with personal information as part of creating an account with usGDPR, we may retain this information for the duration your account exists on our systemCCPA). IfUpon expiration of these periods or upon your verified request, your personal information is no longer required for this purpose, we will delete itbe securely deleted or make it anonymous by removing all details that identify youirreversibly anonymized according to documented protocols.

Legal Explanation

The original clause is vague and lacks defined retention periods or deletion protocols, which are required by GDPR and CCPA. The revision provides clear, enforceable standards and user rights.

4. Insufficient Data Breach Notification Commitment The policy promises to “comply with laws applicable to us in respect of any data breach,” but does not specify notification timelines or user rights. Under GDPR, failure to notify within 72 hours can trigger fines up to 2% of annual global turnover.

Legal Analysis

high Risk

Removed

Added

We will comply with laws applicable to us in respectIn the event of anya data breach involving your personal information, we will notify affected individuals and relevant authorities without undue delay and, where required by law (e.g., GDPR), within 72 hours of becoming aware of the breach. Notifications will include the nature of the breach, likely consequences, and measures taken or proposed to address it.

Legal Explanation

The original clause lacks specificity regarding notification timelines and user rights, which are required by GDPR and other regulations. The revision ensures timely, transparent communication and legal compliance.

Conclusion: Proactive Legal Protection Is Essential Our examination shows that these gaps could result in millions in regulatory fines, costly litigation, and reputational damage. Addressing these issues with precise, enforceable language is critical for risk mitigation.

Are your contracts exposing you to hidden liabilities? How would a single clause change your risk profile? What proactive steps can you take to ensure airtight compliance?

This analysis is for educational purposes only and does not constitute legal advice. For actual legal guidance, consult with a licensed attorney. This assessment is based on publicly available information and professional legal analysis. See erayaha.ai’s terms of service for liability limitations.