...
Title: Data Governance Policy
Subject: Information Resources and Technology
Policy No: IRT:2013:02
Applies: University-Wide
Issuing Authority: Senior Vice President for Information Resources and Technology and Chief Information Officer
Responsible Officer: Senior Vice President for Information Resources and Technology and Chief Information Officer
Adopted: 09/01/2013
Last Revision: 03 08/1808/20212023
Last Reviewed: 03 08/1808/20212023
I. PURPOSE
To set policy for assigning and detailing responsibilities for managing different classifications of university data and to set forth a standard for custodianship of university data. This policy establishes the framework for standards and guidelines to be followed in creation of data storage, destruction, and access mechanisms including data architectures.
...
- NJ Public Records Law General Statutes
- Family Educational Rights and Privacy Act (FERPA)
- Health Insurance Portability and Accountability Act (HIPAA) Security Rule
- NJ Records Retention Schedule for Four Year College
- Americans with Disabilities Act of 1990
- The Electronic Communications Privacy Act of 1986 (ECPA)
- FTC Red Flags Rules
- Gramm Leach Bliley Act (GLBA)
- Payment Card Industry (PCI) Data Security Standard
- General Data Protection Regulation (EU) 2016/679 (GDPR)
- Policy And Procedures On Ethics In Research
- Rowan University Information Security Policy and Standards
- Rowan University Policy on the Privacy of Electronic Information
- University Data
- University Data is a valuable asset at the Rowan University. It involves all University constituencies (students, faculty, staff, etc.) and resources (funds, space, technology, etc.) that are captured and used in the operations of the University. It serves as the basis for internal and external reports.
- University Data enables administrators to assess the needs of the University community and modify services accordingly. It is vital not only in the day-to-day operations of the University but to short-term and long-term planning as well.
- Rowan University exercises control over and access to data even when it is technically open under the public records statutes and even though it requires effort and cost to create and maintain access controls. University data is available only on a need-to-know-basis and requires those individuals seeking access to submit a public records request.
- To support all aspects of University operations, University data in print and electronic form will be managed as a strategic asset according to “data governance” policies and procedures. University data is a subset of the university's information resources and administrative records, and includes any information in print, electronic or audio-visual format. This definition includes, but is not limited to, machine-readable data and data in electronic communication systems. It also includes back-up and archived data on all media, and any University data that resides on internal systems or systems hosted outside the control of the University.
- University data includes data, in any of the forms described above, that is:
- Acquired and/or maintained by university employees in performance of official administrative job duties;
- A public record according to the definition included in Federal and State laws;
- Relevant to planning, managing, operating, or auditing a major function at the University;
- Referenced or required for use by more than one organizational unit;
- Included in official university administrative reports.?
- Access to University data needs to be controlled by defining criteria for its governance and creating mechanisms for enforcing policies related to it. Rowan’s Data Governance Committee (DGC), chaired by Rowan’s Chief Information Officer (CIO), has policy oversight. Distribution of these and related policies, once approved, will be via the Rowan University Policies page on the RU website. ?This policy establishes the framework for standards and guidelines to be followed in creation of data storage, destruction, and access mechanisms including data architectures. ?
- These data architectures will drive physical implementation of databases and be governed according to the provisions of this document.
- Data and records stored on University systems may include data from one or more the following areas within Rowan University AND ARE DESCRIBED IN Exhibit 1.
- Governance Roles
- No one person, department, division, school, or group “owns” the data used by the University, even though specific units bear the primary responsibility for some data. The University as an organization owns the data (or in some cases, such as with Social Security numbers, is the custodian of data), but a specific person in the role of the “Data Steward”, will be designated with the ultimate responsibility to define how the assigned data is managed within the scope of the legal and regulatory obligations.
- The roles and responsibilities assigned to the Data Governance Committee (DGC), Data Stewards, and Data Custodians are included in Exhibits X2, X3, and X4.
- Responsibilities of Users
- Controlling access to University Data is important to protecting the University and its constituency from liability and acts of malice. All public records requests are routed through University Counsel. University employees, faculty, students, and/or agents will be able to access data only after being granted access according to the procedures specified by the Data Steward.
- Permission to access University Data will be granted for legitimate University purposes according to the classification of the data being requested and person making the request. Method of delivery, including email and fax, should be carefully considered to ensure data security and compliance. Requests for University Data from an external source or a University employee for non-University purposes will be handled according to the appropriate Federal and New Jersey Public Records Request statues and case law. Users shall respect the confidentiality and privacy of individuals whose records they may access, observe the ethical restrictions that apply to data to which they have access and abide by applicable laws and University policies with respect to access, use, protection, proper disposal, and disclosure of data.
- To the extent that the law permits, as determined by the Office of University Counsel, the University reserves the right to deny University Data access to any person or organization that has demonstrated malicious intent or has violated any aspect of the Data Governance Policy.
- Data Retention and Disposition
- Rowan University is a state agency, and its offices and departments are obligated to follow the requirements of the Federal and New Jersey Public Records Law for retention and disposition of records. Rowan will comply with the Gramm Leach Bliley Act, including the data destruction provisions therein, with respect to nonpublic personal information that Rowan obtains in the context of providing a financial service. It should be noted here that University Data might not be destroyed without an approved records retention and disposition schedule that authorizes destruction.
- Decisions governing data retention are made based on the content of the data and in conjunction with the department’s approved records retention and disposition schedule. Some types of data may be retained for a long period of time by approved schedules, by policy, or by law. Other types must be purged or destroyed after a certain period of time, again for reasons of preference, policy, or statute. For any circumstance in which data retention is an issue, specific requirements should be clearly documented and should include, at a minimum, the following:
- The rationale for the retention rule
- The timeframe of the retention rule
- The method of either saving or disposing of the data according to the retention rule
...