Overview

These guidelines are intended for UCSB staff, faculty, and students and aim to provide guidelines to data consumers on appropriate use of UCSB institutional data.


A Data Consumer is an individual or unit that accesses, extracts, collects, stores, analyzes, or otherwise uses institutional data for an authorized University purpose. Data Consumers are responsible for handling institutional data in accordance with these requirements and all applicable University policies. 


Institutional data: Data and information stored in UCSB’s administrative computing systems, including transactional data systems, data warehouse solutions, systems containing historical snapshots, and decision support systems. Examples include financial data, student data, employee-sponsored research information, and alumni information.

Data Access and Use Guidelines for Consumers

  • Use data only for authorized purposes.
    Institutional data may be accessed, used, disclosed, or distributed only as necessary to perform assigned University duties and for the specific purposes approved for that access.
  • Do not reuse or share data without authorization.
    Data may not be reused, shared, or disclosed for a different purpose unless the new use is appropriately authorized or was disclosed in the notice provided at the time of data collection, when applicable.
  • Protect privacy and confidentiality.
    Data Consumers must respect the privacy and confidentiality of individuals whose information they access and comply with all applicable University policies and laws governing the access, use, security, and disclosure of institutional data.
  • Do not use data for personal purposes.
    Accessing or using institutional data for personal interest, personal advantage, or any non-University purpose is prohibited.
  • Protect institutional data.
  • Data Consumers must use appropriate logical and physical security controls to protect institutional data, consistent with University policies, applicable guidelines, and UCOP’s Electronic Information Security policy.
  • Specify intended uses when requesting access.
    Requests for data access must clearly describe the intended use of the data, including how the data will be accessed, used, stored, or shared, as applicable.
  • Retain and dispose of data appropriately.
    Data Consumers must retain and securely dispose of institutional data in accordance with University data retention and destruction requirements.
  • Understand the consequences of misuse.
    Violations of data access or use requirements may result in University disciplinary action and, where applicable, civil or criminal penalties, in accordance with University policies and collective bargaining agreements.

For further details review the Rules of Conduct for All UC Employees as established by the UC Office of the President.

Sensitive Data

  • Access is limited to legitimate educational interests. Access to sensitive data—such as self-reported ethnicity, gender identity, sexual orientation, and immigration status—is limited to campus officials who have a legitimate educational interest in the data. These are examples only and are not an exhaustive list of sensitive data.
  • Protect against identification in aggregate reporting. When sensitive data is reported in aggregate, each cell must contain at least 10 individuals. Cells with fewer than 10 individuals must be reported as less than 10..
  • Restrict the use of financial aid data. Under Higher Education Act (HEA) regulations, FAFSA-derived data and other student financial aid information may be used only for administering financial aid programs, including department-administered scholarships. For other purposes, this data may be provided only in aggregate form.

Data Access Regulations

The authorization process and the types of data that may be provided depend on the academic or administrative responsibilities of the requesting department. Some data are subject to additional requirements or restrictions. See the Sensitive Data section above for information about data that have special conditions for access or release.


Student Data

Data Consumers who access student records, regardless of where or how the data are stored or accessed, must understand and comply with the Family Educational Rights and Privacy Act (FERPA). UCSB FERPA training is available through the
UC Learning Center.


Employee Data

Data Consumers who access employee records, regardless of where or how the data are stored or accessed, must understand and comply with applicable federal and state laws and UC and UCSB policies governing the collection, use, and reporting of employee information. When sharing employee data, commonly applicable requirements may include the Information Practices Act, Americans with Disabilities Act, and Confidentiality of Medical Information Act.
Relevant UC policies may include BFB-RMP-7 and PPSM-80.


Public Requests

Any requests from the public for institutional data must be treated as public requests under the California Public Records Act
(see: Public Records).
 

Ending Data Access

When the approved need for institutional data ends, the Data Consumer is responsible for notifying the Data Trustee/Owner and/or Data Steward.

The Data Consumer must then work with the appropriate Data Trustee/Owner, Data Steward, and Data Custodian to:

  • Remove access to systems and data as appropriate; and
  • Securely delete or destroy copies of the data in accordance with applicable laws, regulations, and University policies.