Policy on Information Technology Resources and Account Privacy

The University is committed to ensuring open discourse and the free expression of viewpoints and beliefs. The commitment includes ensuring that academic dialogue is free from unwarranted institutional intrusion and oversight. The purpose of this policy is to articulate the University’s responsibilities and obligations when preserving, accessing, or disclosing information from University information technology resources.

Applicability

This policy applies to all University faculty, other academic appointees, students, post-doctoral researchers, staff, associates, volunteers and contractors (“Covered Persons”) who use University information technology resources and to all uses of those resources, whether physically located on campus or remotely. Although local information technology services at the University may have supplemental policies regarding acceptable use and user privacy expectations, those policies cannot diminish University responsibilities or user privacy expectations as set forth below.

University Obligations to Protect, Search and Disclose Information belonging to Covered Persons

All Covered Persons are expected to respect the privacy interests of those who use University information technology resources. The University also has legal, operational and compliance-based duties, which under specific circumstances require it to preserve and secure custody of information from users’ accounts and associated storage media. In some cases, the University may be required to access user content, search it using specialized software configured with appropriately tailored criteria, review the information found by the search, and disclose relevant portions to others who are duly authorized to receive it. In connection with these responsibilities, the University may also be obligated to request that a user turn over or provide appropriate access to University-related information on the user’s own personal computer, laptop, cell phone, or other electronic device. The University will act as appropriate to fulfill its legal obligations to preserve, review and, as appropriate, disclose data generated and/or maintained by users of University information technology resources. Except to the extent necessary to comply with the University’s legal obligations, the University will maintain the confidentiality of all privileged communications and work product.

When any use of University information technology presents an imminent threat to other users or to the University’s technology infrastructure or poses a likely violation of the law or University policy, the University may take the steps necessary to manage the threat and/or preserve and access data. Those measures may include, but not be limited to changing passwords, removing access rights, disabling or impounding computers, or disconnecting specific devices or entire network segments from University voice and data networks. The University will restore connectivity and functionality as soon as practicable after the threat has been identified and resolved. The University may also implement additional measures to ensure the threat does not reoccur.

Notice

The University will attempt to provide notice in advance to the affected individual of access to or the preservation or sharing of data with third parties, unless such notification would put the University at risk or is prohibited by law. The University maintains the authority to limit access to its networks, systems and services or to remove material stored or posted on its networks, systems, and services when applicable policies, contractual obligations, or applicable laws have been violated or there is a reasonable belief that these have been violated.

Process

The University’s Office of Legal Counsel (OLC) has the responsibility and authority to review and approve all requests to preserve, access, and disclose a user’s electronic information. Although OLC works closely with information technology staff and decision makers across the campus, its ultimate legal and ethical duties are to the institution itself.

At all times, the OLC will use reasoned judgment to determine whether requests are consistent with this policy and the law.

The OLC will confer with the relevant University offices before approving, rejecting or modifying data access requests for the following roles:

• Academic appointees: Office of the Provost
• Students: The applicable Dean of Students and/or the Office of the Vice President of Campus and Student Life
• Staff employees and volunteers: Human Resources
• Other academic appointees and postdoctoral researchers: Respective dean’s office.
• Research: Institutional Review Boards

OLC will establish conditions or other parameters for the access to data under this policy, provide a decision-making framework to allow similar requests to follow consistent processes leading to similar outcomes, and maintain appropriate records of these processes. OLC will maintain a record of all such activity for at least one year and provide summary information to the Audit Committee of the University’s Board of Trustees and the University’s Board of Computing and Academic Services upon request.

Policy Ownership

Responsible University Officer(s): Chief Information Officer
Responsible Office: Office of the CIO
Effective date: 04-12-2024

Definitions

Confidential Information – Generally consists of non-public information about a person or an entity that, if disclosed, could reasonably be expected to place either the person or the entity at risk of criminal or civil liability or damage to the person or entity’s financial standing, employability, privacy, or reputation. Reference University HR policy 601 Treatment of Confidential Information for more information.

Covered Persons – All University faculty, other academic appointees, students, staff, post-doctoral researchers, volunteers, and contractors.

Information Security Program (“The Program”) – The Information Security Program is a set of coordinated services and activities designed to protect University data and information technology and manage the risks to the University associated with those resources, including the regulations below, as well as the procedures, standards, assessments, protocols to govern information resources’ storage, accessibility, and security.

Information Technology Resources – Information technology resources are:

• Computers or electronic resources that are used in the search, access, acquisition, transmission, storage, retrieval, or dissemination of University data.
• Technologies or services that are owned, contracted by, or managed by the University that connect to the University network or link to another University technology or service or store University data or information.
• Services or applications used by the University in hosted environments where the University does not own or operate the technology infrastructure.

Service – IT infrastructure, platforms, or software hosted by third-party providers and made available to users through a network.

Third-Party – An organization or partner that the University contracts with to perform certain services on behalf of the University.

Covered Data – Data created, stored, or maintained, by or on behalf of the University.

Roles and Responsibilities

Office of Legal Counsel – The OLC provides guidance and facilitates the process that policy refers to.
Chief Information Officer (CIO) – The CIO is responsible for providing guidance to University leadership concerning the appropriate use of information technology resources.
Chief Information Security Officer (CISO) – The CISO shall be responsible for leading the development, execution, monitoring, and enforcement of the University Information Security Program.

Related Information

University HR policy 601 Treatment of Confidential Information for more information.
Acceptable Use of Information Technology Policy

Contacts
The following offices can address questions regarding this Policy:

Frequently Asked Questions

These FAQs are subject to change and will be updated as needed.
Last Updated: 3/8/24