Rule 3341-6-39 | Sensitive data privacy.
(A) Policy statement and purpose
BGSU must protect its information resources, comply with laws and applicable statewide policies issued by the Ohio office of information technology (OIT) under the authority of the Ohio Revised Code, and comply with other university policies regarding the protection and use of university data and information technology resources. As a result, the policy on sensitive data privacy has been established.
(B) Policy
BGSU stakeholders must have the ability to collect and process information for administrative and academic purposes. Information collected and processed may include sensitive information.
Sensitive information includes personal information and proprietary information of the university included but not limited to: social security numbers, driver license numbers, credit card or other financial account numbers, BGSU ID numbers, protected health information, financial data, educational records, intellectual property or research records, donor profiles, or any information that could result in a material risk of identity theft, a violation of the family educational rights and privacy act, or otherwise harm the legitimate financial and reputational interests of the university if unauthorized access is permitted, whether intentionally or unintentionally.
BGSU stakeholders are to use university information on university owned media or equipment. BGSU stakeholders are not to store, communicate, transport, or process university information on personally owned media, devices, or computers without prior written approval from the appropriate vice president and the approval of the personal equipment by information technology services (ITS).
Information on university owned portable devices such as flash drives, disks, or laptop computers must be stored in physically secure locations and is not to be transported without encrypting the data using university approved software and techniques.
Software, policies, and procedures for encrypting sensitive information are currently installed. To schedule encryption installation for a university owned portable device, contact the technology support center (TSC) at extension 20999 or email at tsc@bgsu.edu.
The Ohio Breach Notification Act requires prompt notification to individuals whose personal information has been exposed if the incident could lead to fraud or identity theft. Any loss of sensitive data, disclosure of sensitive data to unauthorized individuals or suspected misuse of sensitive data must be immediately reported to the office of the CIO.
(1) Related policies
(a) Code of ethics and conduct; core values; information technology policy; records retention requirements
Date: August 6, 2013
Supplemental Information
Amplifies: 3345