糖心破解版 Data Security & Privacy Protection Administrative Procedure – DRAFT

APPLICATION: This administrative procedure applies to all individuals who collect, use, or share district information. Those individuals include, but are not limited to, staff, faculty, those working on behalf of the district, and individuals authorized by affiliated institutions and organizations.
ISSUED: 11/28/2019
DATA PROTECTION OFFICER: Director of IT Infrastructure and Security

Purpose

糖心破解版 seeks to ensure that its treatment and use of personally identifiable information and other sensitive information complies with all applicable statutes and regulations while demonstrating the District鈥檚 commitment to maintaining its confidentiality and integrity.

Scope

This administrative procedure governs information that the district or authorized agents collect, use electronically or physically, and share with others.

The collection, retention and release of some information may be covered by law or regulation; including but not limited to the Family Educational Rights and Privacy Act (鈥淔ERPA鈥�); the Health Insurance Portability and Accountability Act (鈥淗IPAA鈥�); the European Union General Data Protection Regulation (鈥淓U GDPR鈥�); and the California Consumer Privacy Act (CCPA); and this administrative procedure is not meant to supersede requirements related thereto.

For the sake of this administrative procedure, personally identifiable information (鈥淧II鈥�) is any non-public information that can identify or provide information about an individual.

Data Classifications

Public

This is defined as information that is generally available to anyone within or outside of the District. Access to this data is unrestricted, may already be available, and can be distributed as needed. Public data includes, but is not limited to: fundraising materials, admission recruiting materials, information posted on public web pages, and directory information. 聽This data can be used and stored on any district managed system without additional safeguards in places.

Confidential

This is information that may be considered damaging if released. 聽Confidential data examples include financial records and all PII not considered Restricted. 聽Confidential data can only be collected, used, or stored in approved systems or encrypted workstations. 聽This data cannot be shared outside the district without approval of the general counsel and DPO.

Restricted

This is defined as highly sensitive data, which if leaked, has a moderate to high risk on privacy, safety, or financial situation. 聽Restricted data includes, but is not limited to: grades, social security numbers, HIPAA data, credit card data, and controlled unclassified information. 聽Restricted data can only be collected, used, or stored in systems approved by the DPO. 聽This data cannot be shared with new people inside the organization or outside the organization without approval of the general counsel and DPO.

 

Data Collection

Confidential and Restricted information may only be collected by authorized personnel where it is specifically needed for a legitimate district business requirement or to meet a statutory or regulatory requirement. The district strongly discourages the collection or retention of this information except where absolutely necessary and no other alternative exists.

Data Sharing

Confidential and Restricted data may only be released or provided to others on a need to know basis in compliance with the required approvals above. As a condition to receiving such information, all recipients must agree to the terms of this administrative procedure. (e.g., vendors)

Protection of Confidential and Restricted Data

  • Management is responsible for ensuring that their direct reports understand the scope and implications of this administrative procedure.
  • HR is responsible for ensuring that all employees acknowledge receipt of this administrative procedure.
  • Individuals contracting with third parties must ensure that appropriate provisions exist in agreements to maintain the confidentiality and integrity of the data in compliance with applicable laws and regulations.
  • Personal account passwords should never be shared. 聽Individuals are held accountable for all activity performed with their accounts in accordance with our .
  • Any authorized party who collects or generates new data must classify that data according to the criteria outlined above and notify the DPO to ensure appropriate tracking and protection.
  • Confidential and Restricted data protection should be based on the following security principles
    • Risk Assessment 鈥� appropriate protections should be defined based on the perceived risk to the data and possible harm due to unauthorized disclosure.
    • Least Privilege 鈥� individuals should only be given the access that they need to complete their assigned duties
    • Need to know 鈥� individuals should only be aware of information that they must know to complete assigned their duties
  • Any person in possession of Confidential and Restricted data shall safeguard the data to the best of their ability and shall destroy, erase or make unreadable such data in whatever form it exists prior to disposal in accordance with .
  • Confidential and Restricted data cannot be saved to personal equipment.
  • Confidential and Restricted data in paper or physical form shall be kept in closed, secured cabinets or rooms.
  • Any constituent who discovers possible evidence of a violation of this administrative procedure or possible breach or release of Confidential and Restricted data shall immediately notify the DPO and take care to preserve any and all evidence of such incident. 聽Upon confirmation of a breach or unauthorized disclosure of confidential or restricted data, the DPO shall initiate a security incident in adherence with the information security incident response procedure.
  • All district managed systems will be scanned for confidential and restricted data to help ensure compliance with the standards set above. 聽If confidential or restricted data are found on a system, the user must delete the data if no longer necessary, or move the data to an approved location. (e.g., encrypted hard drive or file share)
  • Information security and privacy staff will monitor for unauthorized activity and update requirements where appropriate.

Additional Information

For additional guidance specific to GDPR, please refer to Exhibit A: 糖心破解版 European Union General Data Protection Regulations (EU GDPR) Policy.

For additional details about our data collection, usage, and sharing, please refer to聽Exhibit B: 糖心破解版 Data Collection, Usage & Sharing

For additional guidance specific to CCPA, please refer to Exhibit C: 糖心破解版 California Consumer Protection Act (CCPA)

administrative procedure Enforcement

Staff, faculty, or students found in violation of this administrative procedure may be adjudicated per their respective handbooks.

Questions, comments, or concerns regarding this administrative procedure or the protection of data should be directed to the Data Protection Officer at helpdesk@yccd.edu.