Data Use & Protection Policy

Purpose

Information in the form of data is a critical asset and essential to the operation of Owens Community College. The purpose of this rule is to ensure faculty, staff and students appropriately access and protect data from improper use or release and that Owens Community College is in compliance with all applicable federal, state and other laws, contracts, regulations and licenses.

Definitions

  1. Data at the College includes, but is not limited to: student records, personnel data, financial/accounting data, administrative records, institutional research, confidential legal or medical information, alumni and donor information. Data may include facts, files, records, reports or any information meant only for internal use and/or is restricted, limited or public information. Such data and information may be in existing or archived form, or in physical or digital form.
  2. A data owner or steward is a College employee assigned planning and management-level responsibility for defined segments of institutional data and for data within their functional area. A data owner is responsible within their functional area for assigning and overseeing authorized data users, overseeing the establishment of data classification and processes, determining legal and regulatory requirements for data and promoting appropriate data use and data quality.
  3. A data user is any authorized College faculty member, staff member or student who accesses, modifies or handles data.

Data Classifications

A data owner should determine the classification of institutional data within their area of responsibility.

Public

Data that must be released under the Ohio Public Record Act or where the College unconditionally waives an exception to the public record law.

Limited Access

Data that may be released by the College if it chooses to waive exception to the Ohio public record law and places a condition or limitation on such release. A notification of unauthorized access is not required for any such victim or other outside entity. Examples include, but are not limited to, college identification numbers, research data and intellectual property.

Restricted

Data release is prohibited by federal law, state law, and/or contractual obligation. For data to be defined as restricted, a notification of unauthorized access must be provided to any such victim or other outside entity. Examples include but are not limited to: social security numbers, personal health information and driver’s license numbers.

Responsibility

  1. A data user must use and protect data in a manner consistent with all relevant standards and procedures of information technology services and the rules of the College.
  2. A data user must be aware of and comply with all applicable federal, state, and other laws, contracts, regulations and licenses. A data user may reference Owens Community College rule 3358:11-6-01 of the Administrative Code (information technology policy).
  3. A data user must understand the classification of the data being accessed and protect it appropriately based on that classification.
  4. A data user must only access or attempt to access data, as based on the authorization to use, and then only use such data in the manner and to the extent authorized.
  5. A data user must provide data only to another data user who is authorized to receive it.
  6. A data user must not share or use accounts, passwords or other authentication mechanisms not assigned by the College.

Non-Compliance

Non-compliance with this rule and corresponding procedures may be subject to the Owens Community College rule 3358:11-5-52 of the Administrative Code (standards of conduct and disciplinary process policy and corresponding procedures) or the college’s student code of conduct.

Implementation

The treasurer/chief financial officer or the chief information officer has the authority to promulgate procedures, guidelines and forms consistent with this rule.

All users of the information technology resources may refer to data user definitions (PDF) and standards for the College’s information technology services.

Effective date: 12/14/2019

Promulgated under: 111.15
Statutory authority: 3358.08
Rule amplifies: 3358.08
Prior effective dates: N/A