ROWAN UNIVERSITY POLICY
Title: Records Release Policy and Security of Donor Information
Subject: University Advancement
Policy No: UA: 2014:02
Applies: University-Wide
Issuing Authority: President
Responsible Officer: Associate Vice President for University Advancement/Executive Director, Rowan University Foundation
Adopted:
Last Revision: 9/2014
Last Reviewed: 4/14/2015
I. PURPOSE
This policy outlines a code of ethics and principles for the stewardship of the personal information of University constituents and provides a Donor's Bill of Rights. It also includes an overview of donor anonymity levels, a privacy policy statement regarding use of the Millennium database, processes for the request of information from Millennium, best practices regarding safeguarding alumni and donor privacy, and a statement of understanding for all campus Millennium users.
II. ACCOUNTABILITY
Under the direction of the President, the Associate Vice President for University Advancement/Executive Director of the Rowan University Foundation shall ensure compliance and implementation of this policy.
III. APPLICABILITY
This policy is applicable to all members of the Division of University Advancement, all campus users of Millennium, and all University offices, affiliated organizations and alumni constituent groups that request information from the Millennium database.
IV. POLICY
A. Mission Statement:
- Rowan University Advancement employees are ethically obligated to respect and safeguard the privacy rights and the confidential information obtained from Rowan University alumni, prospects and donors. It is important that Advancement employees act with integrity and are honest in their dealings with the University and with those that they come in contact with. Advancement employees shall avoid conflicts of interests and may not accept favors or any other benefits for personal gain and shall follow the letter and spirit of the laws and regulations affecting advancement and observe these standards by also encouraging your colleagues to do so as well.
- Staff Members of Rowan University's Division of Advancement are entrusted with sensitive and personal information regarding University alumni, prospects and donors. It is therefore incumbent upon each employee to protect the privacy rights of those who have dealings with the University. An employee's stewardship of personal information can be guided by the following code of ethics and principles set forth below:
- Privacy – University Advancement should neither obtain nor retain nonessential and highly personal information about donors in their paper or electronic files. Also, care must be taken to ensure that Advancement staff members do not take information about donors with them when they change jobs. University Advancement employees need to be methodical stewards of personal information in an era where privacy concerns rightly run rampant.
- Stewardship – University Advancement must assure the donor that the funds the University receives are indeed being used for the purposes for which they were given. The University must honor the spirit as well as the letter of donor intentions.
Honesty and full disclosure – University Advancement must give our alumni, prospects and donors enough information to make informed giving decisions. Honesty with donors is the essential foundation of healthy benefactor relations.
Conflicts of interest – An employee of the Advancement Division must avoid engaging in any activity that would put the interests of the donor, the University, and the employee's personal interest at odds with one another. All transactions should be completely transparent and devoid of conflicting interests. - The appearance of impropriety – There are many things that fundraisers can do that are legal, but are unethical, such as benefitting personally from a benefactor's estate gift, bequest or outright gift. Our profession views such behavior negatively. University Advancement employees shall refrain from engaging in such activities.
B. Donor's Bill of Rights
Philanthropy is based on voluntary action for the common good. It is a tradition of giving and sharing that is primary to the quality of life. To ensure that philanthropy merits the respect and trust of the general public, and that donors and prospective donors can have full confidence in the nonprofit organizations and causes they are asked to support, we declare that all donors have these rights:
- To be informed of the organization's mission, of the way the organization intends to use donated resources, and of its capacity to use donations effectively for their intended purposes.
- To be informed of the identity of those serving on the organization's governing board, and to expect the board to exercise prudent judgment in its stewardship responsibilities.
- To have access to the organization's most recent financial statements.
- To be assured their gifts will be used for the purposes for which they were given.
- To receive appropriate acknowledgement and recognition.
- To be assured that information about their donation is handled with respect and with confidentiality to the extent provided by law.
- To expect that all relationships with individuals representing organizations of interest to the donor will be professional in nature.
- To be informed whether those seeking donations are volunteers, employees of the organization or hired solicitors.
- To have the opportunity for their names to be deleted from mailing lists that an organization may intend to share.
- To feel free to ask questions when making a donation and to receive prompt, truthful and forthright answers.
C. Privacy Policy
- Rowan University's Department of Advancement Services (DAS) maintains a database (Millennium) of biographical and gift/pledge information about University alumni and friends in accordance with the general needs and expectations of the University community. The information contained in this database is intended exclusively for purposes related to Rowan University's programs.
- Staff members of University Advancement will have access to Millennium [alumni and/or development information as well as data analysis] from their workstations. Each employee user should diligently deal with sensitive information regarding alumni, prospects and donors in the areas of data retrieval, retention, dissemination and disposal. This policy document is designed to protect the privacy of Rowan University alumni and other constituents and to maintain standards of confidentiality associated with electronic records in Millennium. Exceptions to this policy can only be made by the Vice President of University Advancement or his/her designee.
- An employee's need to access Millennium does not equate to casual viewing. It is the employee's obligation, and his/her supervisor's responsibility, to ensure that access to Millennium is only to complete assigned functions.
- The Director of Advancement Services in recognition of the right to privacy of donors to Rowan University, ethical considerations, and the need for good donor relations has categorized Millennium data as restricted. Data and information available in Millennium and in related reports and files is the property of Rowan University and its use is governed be federal, state and local law, as well as University regulations. It may only be used to support University-sponsored or University-approved development or alumni relations functions.
- The Department of Advancement Services expects that individuals with access to Millennium data understand their responsibilities with respect to use, interpretation and distribution of that data and the consequences for misuse of data. The ability to access and produce reports and mailings does not constitute automatic authority to do so. Unauthorized release or use of Millennium information for any purpose is strictly prohibited and may result in suspension, and/or termination of employment for the employees involved. Additional legal action may be taken, when warranted.
- It is the desire of the Department of Advancement Services to support the ongoing activities of Rowan University by providing assistance for programs, communications, and events, which bring together alumni, donors, and friends of the University. In order to provide the best possible service to those with legitimate needs for such information, and at the same time maintain the confidentiality of the information entrusted to us by our alumni, the following policies have been developed.
D. Responsibilities
- Exceptions to this policy can only be made by the Associate Vice President of University Advancement or his/her designee.
- In cases of dispute about whether an organization has a legitimate affiliation with the University, the final decision will rest with the Associate Vice President of University Advancement or his/her designee.
- In cases of dispute about what constitutes an approved activity, the final decision will rest with the Associate Vice President of University Advancement or his/her designee.
E. Compliance with the above policy.
Failure to abide by any of the policies stated within this document may result in denial of access to information contained in the Millennium database. Request for re-instatement of access to this information must be approved by the Director of Advancement Services and must include written assurance of future compliance with these policies.
VI. ATTACHMENTS
A. Attachment 1, Department Procedures
B. Attachment 2, Donor Anonymity
C. Attachment 3, Millennium Database Information
D. Attachment 4, Protecting and Preserving Rowan Alumni and Donor Privacy
E. Attachment 5, Internal Uses of Information
F. Attachment 6, Distribution of Information
ATTACHMENT 1
DEPARTMENT PROCEDURES
- All University Advancement employees and campus users of Millennium will know and abide by the code of ethics and principles regarding personal information of alumni, prospects and donors as set forth.
- All University Advancement employees will know and abide by the Donor's Bill of Rights and donor anonymity levels as set forth.
- All campus Millennium users will understand their responsibilities with respect to use, interpretation and distribution of the system's data and the consequences for its misuse.
- All University offices, affiliated organizations and alumni constituent groups requesting information from the Millennium database will adhere to restrictions regarding "public information" and its proper distribution.
- All individuals with access to Rowan University alumni and donor information will adhere to guidelines regarding the successful protection and preservation of the data.
- All Millennium users are required to sign a Statement of Understanding.
STATEMENT OF UNDERSTANDING FOR MILLENNIUM USERS
I, the undersigned, have read and understand the policies for access to and privacy of Rowan University Alumni and Donor records. I agree to use the information provided only for the approved University program(s). Furthermore, I understand that the use of the information for political or commercial purposes is strictly prohibited.
__________________________________________ __________________________________________
Name (print or type) Department
__________________________________________ __________________________________________
Signature Date
__________________________________________ __________________________________________
Supervisor Signature Supervisor Approval Date
Complete in duplicate:
Copy (1) Millennium User
Copy (2) Office of Advancement Services
ATTACHMENT 2
DONOR ANONYMITY
The University Advancement office recognized three levels of donor anonymity. It is important that we honor the spirit as well as the intent of a donor. Occasionally, a University Advancement Employee will encounter a donor, individual, or an organization that desires to remain anonymous. When a request to remain anonymous has been made, the Employee should take steps to identify the appropriate level of Donor Anonymity to assign to that donor. Below are the three levels of Donor Anonymity. Use them as a guide when determining which level of Donor Anonymity should attach to the donor.
Level I
The Donor provides his or her name, address, and/or other biographical information and communicates that he/she wishes to remain anonymous regarding and in reference to this specific one-time gift. The gift/pledge transaction shall be tagged as "Anonymous." The Division of University Advancement retains the donor's biographical information for internal uses only.
Level II
The Donor provides his or her name, address, and/or other biographical information and communicates that he/she wishes to remain anonymous regarding this gift as well as all future gifts made by this particular donor. An Alert shall be created in the Millennium database, which shall attach to this particular donor and shall signal the donor's request to remain anonymous each time the donor's profile is accessed. The Division of University Advancement retains the donor's biographical information for internal uses only.
Level III
The Donor at this level is truly anonymous. The Donor refuses to provide the Advancement Employee with his or her name, address, or any other biographical information and communicates his/her desire to make a gift on the condition of complete anonymity. The Advancement Employee shall assign the donor a generic identification title and number (i.e. Anonymous Donor 2011 #1234). The Advancement Employee shall then forward all information pertaining to the Level III donor to the Vice President's Office where upon receipt shall document and maintain a file of such Level III donors.
ATTACHMENT 3
MILLENNIUM DATABASE INFORMATION
The Following May Request Information from the Millennium Database:
- University-affiliated organizations and alumni constituent groups, in support of approved activities include, but are not limited to the organizations listed below. In cases of dispute about whether an organization has a legitimate affiliation with the University, the final decision will rest with the Vice President of University Advancement or his/her designee.
- Rowan University Alumni Engagement
- Alumni constituent groups chartered under the Rowan University Alumni Association
- Rowan University Development
- Administrative units of Rowan University
- Academic units of Rowan University
- Athletic units of Rowan University
- Central Administration
- Career Development Center(s)
- Law enforcement agencies and student loan agencies.
- Agencies that assist the Department of Advancement Services in locating Rowan University's lost alumni, e.g. AlumniFinder, AlumniSync, HEPData, etc.
- All requests from anyone seeking information on another person will be forwarded to that person so that he/she can decide whether or not to contact the requestor. No information will be released for those records coded "Do Not Release" indicating the alumnus or alumna has requested no University contact.
- All requests for information from members of the media must be referred to the Division of University Relations.
Information That May be Released from the Millennium Database:
- Information available for release is confined to "public information" i which is limited to:
- Full name
- Address and telephone number
- Degree(s) and date of degree(s) awarded by Rowan University
- School(s) from which degree(s) was/were granted with major field of study
- Employer address and telephone number
- E-mail address
- Fax number(s)
- Federal law severely restricts the amount of information that may be released on current students ii . No information on students will, therefore, be released based on data maintained by Millennium. All requests for information on current students should be forwarded to the appropriate Registrar's office.
- Information provided to volunteer alumni constituent groups will be limited to those alumni who are affiliated with the requesting group.
- In addition to "public information," requests from the Rowan University Alumni Association; Development; administrative, academic, or athletic units of Rowan University; and Central Administration will be provided the following information:
- Employment History
- Student activities
- Alumni activities
- Family members
- Degrees obtained from other Schools
- Miscellaneous comments, awards, text, etc.
- Gift/Pledge data
ATTACHMENT 4
PROTECTING AND PRESERVING ROWAN ALUMNI AND DONOR PRIVACY
- Securing Paper Records
- Store paper records in a room, cabinet, or other container that is locked when unattended
- Ensure that storage areas are protected against destruction or potential damage from physical hazards, like fire or floods, by keeping doors closed and items off the floor
- Promptly shred and dispose of outdated constituent information recorded on paper
- Securing Computers and Electronic Records
- Shut down applications if you leave for lunch or any extended period of time
- Use password-activated screensavers
- If you use a computer other than the one you have been assigned, leave a note to notify the assigned user that includes the date and your name as an authorized employee of the College
- Use strong passwords (at least eight characters long) including numbers and letters and non-numeric characters
- Change passwords every ninety days
- Do not post passwords near your computer (for example: passwords written on post-it notes)
- Do not download unauthorized files
- Check with software vendors regularly to obtain and install patches that resolve software vulnerabilities (for example: Microsoft updates, internet explorer upgrades, etc.)
- Use anti-virus software that updates automatically
- Store electronic customer information on a secure server that is accessible only with a password - or has other security protections (for example: in Banner or on network drives, which are backed up by I.T. nightly)
- Maintain secure backup media and keep archived data secure, for example, by storing off-line or in a physically-secure area
- If you transmit sensitive data by electronic mail:
- DO NOT include the constituent's social security number or credit card information
- But DO include a confidentiality notice:
"This communication, including any attachment(s), contains information that may be confidential or privileged, and is intended solely for the individual(s) to whom it is addressed. If you are not the intended recipient, please notify the sender at once and then delete this message. You are hereby notified that any disclosure, copying, or distribution of this message is strictly prohibited." - Secure laptops to avoid theft and possible access to constituent data when traveling and in the office – lock doors when leaving for the day
- Do not save constituent data on your home computer
- Backup your hard drive on a regular basis
ATTACHMENT 5
INTERNAL USES OF INFORMATION
Acceptable Internal Uses of Information from the Millennium Database
- Rowan University's Department of Advancement Services will make available information from Millennium for the support of approved, University-related activities. Approved activities include the following:
- Alumni engagement
- Development
- Public relations
- Government relations
- School/department communications to alumni/constituents
- University-sanctioned research
- Continuing education programs
- Student recruitment
- In cases of dispute about what constitutes an approved activity, the final decision will rest with the Vice President of University Advancement.
- Information maintained by Millennium is not available for release for non-related commercial or political purposes.
- If the information provided will result in the preparation of lists or directories that are to be published in book, magazine, newsletter or other forms for general distribution among alumni groups, prior to publication each individual who might be included must be provided the opportunity to indicate in writing whether he/she wishes to be excluded.
ATTACHMENT 6
DISTRIBUTION OF INFORMATION
Formats Available for Distribution of Information
Information may be obtained in the form of lists, labels, electronic files and downloads by authorized university representatives in support of approved activities as noted in Section III.A of this document. It is the responsibility of the unit requesting information to maintain the absolute confidentiality of that information as specified in this policy statement.