EDUCAUSE Seminars in Academic Computing Executive Leadership Seminar

EDUCAUSE Seminars in Academic Computing Executive Leadership Seminar Aug. 3 -5, 2007 Beth Cate, Associate General Counsel, Indiana University

Data Privacy and Security Managing Risk

Managing risk generally requires the exercise of control…which can be thin on the ground in our environment!

Control? ¡ Our roles are expanding and our operations are becoming more complex l l Educators, researchers, housing providers, health care providers, lenders, engines of economic growth, entertainment brokers, state resource banks More collaboration with other institutions and with private industry

Control? ¡ Awash in data—students, personnel, research subjects, patients, alums, donors, vendors/contractors, external partners l ¡ Sensitive personal information woven throughout these data New roles and initiatives prompt new ideas for using and sharing data internally

Control? ¡ Often decentralized environment for data creation and management l l To some extent, in schools’ DNA RCM and similar budget approaches Not always the same level of critical thought about what data is being collected, maintained, used ¡ Not always the same level of skill or knowledge in handling data ¡

Control? ¡ Resource constraints create incentives to aggregate and share data – both internally and externally l l l Internal efficiencies Outsourcing Enhancement of alumni and foundation functions

Control? ¡ External requests/demands for data l l ¡ Law enforcement Government regulators Members of the public/oversight organizations Litigants Constituent expectations that we will oppose some of these requests

Control? ¡ Increasingly complex legal landscape with respect to privacy and security of personal information within institutional data l l l In absence of federal standards in some areas, states fill in gaps – 50 state standards to confront Contractual obligations too, e. g. PCIDSS Litigation

Control? ¡ Legal standards will be influenced to some extent by what government and industry are doing in the areas of privacy and security (others with greater resources…. ) l l l Privacy Officers and offices Authentication/identity management Encryption

Control? ¡ Not just the law we need to be thinking about but our constituents’ expectations l Public discourse on privacy/security doesn’t always take into account competing values and needs

So we just need to figure out… ¡ ¡ ¡ How to design and carry out operations in a way that lets institutions pursue their operational goals while minimizing risk of legal, ethical, and PR problems How to parse what are/are not IT issues and to deal effectively with the “human agency” factors How to help set appropriate expectations about data privacy and security