A. Statement of Need

Sweet Briar College relies increasingly on data stored in information processing systems on a wide variety of computing resources at the college to satisfy the college information requirements and to further its educational mission. Security of this data, its proper, lawful use and access to that data is essential. The data must be both maintained accurately and stored and transmitted securely if the institutional mission as well as college, federal and state regulations regarding privacy and freedom are to be followed. Obligations regarding institutional data apply to that data whether it is maintained on centralized administrative systems or on computers located in offices or other campus buildings. Considerations regarding privacy, security and proper disposal applying to paper copies of information apply as well to electronic data. Where data is tranferred from institutionally owned computers to computers used by employees of the institution in other locations, e.g., at home or travelling, all policies regarding data security and confidentiality shall apply.

B. Lawful Use and Access

The data policies of Sweet Briar College are covered under applicable Federal laws and regulations and the laws of the Commonwealth of Virginia. College policies are consistent with all applicable regulations.

C. Data Privacy

Members of the Sweet Briar community are responsible for ensuring that their uses of the college's data are consistent with the college policy on privacy of information.

Rationale

The college commitment to protect the personal privacy of members of the Sweet Briar community is long standing and strong. It is clearly expressed in policy, in elements of the organization's structure, and in practice.

"Recognizing that specific items of information about individual students, faculty, and staff (as well as former students, faculty and staff) must be maintained for the educational, research, and other institutional purposes of Sweet Briar, it is college policy that such information be collected, maintained, and used by the college only for appropriate, necessary, and clearly defined purposes, and that such information be controlled and safeguarded in order to insure the protection of personal privacy. ..Such information should not be used or exchanged within the college for purposes other than those stated or related, legitimate purposes that would be reasonably expected."

Implications

The Institute's policy on privacy of information applies for all the colleges data, regardless of the storage form or location. With the rapid proliferation of information technology in college offices and the interest in new applications, such as computerized phone directories, protection of individual privacy will occur only if all members of the community know about the policy and are diligent about complying with it.

Recipients of confidential data in files downloaded to workstations must maintain the confidentiality of those data. People who develop new applications in central offices or other departments must assure that their use of information conforms with the privacy policy. They will, for example, have to notify students and staff when information about them, collected for other purposes, will be put to a new use and give people the chance to refuse to have data about themselves included.

Implementation

Contents of the various policy and procedure communications on this subject will be coordinated to assure that all members of the community understand the policy on Privacy of Information and their responsibilities for compliance with it, for both computerized and manual records in all offices.

D. Data Custodian

It is the responsibility of the designated custodian of a particular data collection to ensure data integrity, security and accessibility to all who demonstrate need.

Rationale

Among all the business data stored in many locations at the college, certain collections of data have been designated the official records of Sweet Briar College, and certain officers of the college have been designated the custodians of those official records.

The practice of custody has over the years been extended to include implicit custodianship of the computerized data from which official records are now usually printed. Although it is appropriate that ownership of the data be assigned to the college and accessibility be available to all who demonstrate need, it is also necessary to designate an identifiable focal point for assuring the protection of the records' accuracy, integrity and security.

Implications

The roles and responsibilities of custodians for computerized information must be clear and broadly understood. The responsibilities are complex, balancing the sometimes competing demands of daily operations, accessibility, privacy, legal constraints, and accuracy. Efforts to resolve complexities can lead individual custodians to differing interpretations of their roles. The differences may have frustrating results, especially for those who need to combine information from more than one data collection, as many departmental administrators do.

Identification of custodians must be explicit, but is increasingly complicated as offices share information and computerized databases. Resolving custody identification issues may impact current organizational forms.

Implementation

A custodian will be identified for each collection of administrative data. For those data collections that cross organizational boundaries, the custodianship of individual data elements will be established.

Responsibilities of custodians for the data's logical and physical integrity and for responding to requests for access to the data will be clarified and communicated to all concerned.

Custodians will provide information about the data collections to the Director of Computing for the directory of the collections of the college's information.

E. Statement Regarding Ownership of Information

Where information regarding the business of Sweet Briar is provided for use outside the college, it shall be transmitted with the following statement appended:

"This information is the property of Sweet Briar College and herein reserved as proprietary information. No part of this information may be disclosed or used without proper written consent of an authorized representative of Sweet Briar College."

Data provided for purposes of public relations and information, for the dissemination of scholarly activity, and that designated as directory information shall be governed by appropriate college policies, federal and state regulations and accepted practices of scholarly communication.

F. Action Regarding Violation of Policy

Violations of data security policies as well as guidelines, standards and procedures pursuant to these policies may be grounds for disciplinary action. Such action is in addition to any criminal or civil liability under applicable laws that may result from violations.