Data Governance Policy

Purpose

College Data is a valuable asset to all constituencies at Emerson College (students, faculty, staff, etc.) and requires the coordinated use of significant resources (funds, space, technology, etc.) involving all operations of the College. College Data enables the institution to assess the needs of the College community and to manage and modify its services and operations accordingly. It is vital not only in the day-to-day operations of the College but to short-term and long-term planning, and it serves as the basis for internal and external reports.

Appropriate and timely access to College Data is critical for the efficient and effective operation of the College. Controlling access to College Data and keeping data confidential is also important to protect the College from accidental loss or destruction of data, liability, and acts of malice.

The objectives of this policy are to:

• Detail responsibilities for managing College Data.
• Establish a framework for standards and guidelines to be followed in the creation of data storage, destruction, and access mechanisms.

Scope

This policy is applicable to all individuals accessing College Data (Users of College Data).

Nothing in this policy precludes or addresses the release of College Data to external organizations, governmental agencies, or authorized individuals as may be required by legislation, regulation, or other legal obligation.

Definitions

For purposes of this policy, the following definitions apply:

Access: The ability to read, copy, modify, delete, or query data.

College Data: Data that is created, acquired or maintained by the College. College Data includes, but is not limited to, data that is: (a) acquired and/or maintained by College employees in the performance of administrative job duties; (b) relevant to planning, managing, operating, or auditing a major function at the College; or (c) referenced or required for use by more than one organizational unit. College Data may reside on College-owned systems or systems owned by third parties.

Confidential Data: College Data classified as High Risk or Moderate Risk whose unauthorized access, loss, or corruption would pose a significant financial, legal, or identity risk to the College or its constituents, and is therefore not available to the general public.

Users of College Data: Any person granted access and use privileges to College Data. This includes students, faculty, visiting faculty, staff, volunteers, alumni, persons hired or retained to perform work for the College, and any other person granted access and use privileges by the College under contractual agreements or otherwise.

Data Custodians: College officials and their staff who have operational-level responsibility for data capture, data maintenance, and data dissemination.

Data Stewards: College officials who have policy-level responsibility for managing a segment of College Data.

Personal Information: Per the Massachusetts regulation for Personal Information and Breach of Security, a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security Number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number ("PIN"), or password that would permit access to a resident's financial account. The term "personal information" does not include that information which is lawfully obtained from publicly available information (such as addresses or birthdays), or from federal, state, or local government records lawfully made available to the general public.

Health Information: Health data created, received, stored, or transmitted in relation to the provision of healthcare, healthcare operations, and payment for healthcare services.

Statement of Policy

Regulations, Statutes, and Policies

Responsibility for and access to College Data is governed by the following policies and legal statutes:

• Massachusetts Data Protection Law
• Family Educational Rights and Privacy Act (FERPA)
• Health Insurance Portability and Accountability Act (HIPAA)
• Gramm Leach Bliley Act (GLBA)
• European Union General Data Protection Regulation (GDPR)
• Payment Card Industry (PCI) Data Security Standard
• Emerson College Written Information Security Policy
• Emerson College Records Management Policy
• Emerson College Conflict of Interest Policy

Data Stewardship and Custodianship

The College as an organization owns its data (or in some cases, such as with Social Security numbers or other personal data, is the custodian of data), and specific departments and positions in the roles of Data Stewards are responsible for different segments of that data. These departments and Data Stewards shall define how the assigned data is managed within the scope of the legal and regulatory obligations.

Data Stewards are responsible for:

• Assigning Data Custodians in their respective area(s).
• Enforcing the requirements of this policy.
• Setting additional/internal standards, procedures, and expectations for how Data Custodians handle College Data. Data Stewards are empowered to determine if their data was handled appropriately by their designated Data Custodians.

Data Custodians will authorize access to College Data only on a need-to-know-basis. Individuals seeking access will submit a request for approval to the appropriate Data Custodian that has responsibility for the data at issue.

Data Custodians will grant access to College Data for legitimate College purposes according to the classification of the data being requested and the internal expectations set by their Data Steward. The method of transmittal of any College Data must be in compliance with the College's Data Classification Guideline.

Data Handling and Collection

Users of College Data shall respect the confidentiality and privacy of individuals whose records they may access, and shall abide by applicable laws and College policies (listed in this policy) with respect to access, use, protection, proper disposal, and disclosure of data.

To the extent that the law permits, as determined by the Office of General Counsel, Data Stewards reserve the right to deny access to any person or organization to College Data for any reason.

No person or party may collect College Data (i.e., through online or paper forms, solicitations, etc.) without authorization from the appropriate Data Custodian.

See the Records Management Policy for data retention requirements, schedules, and practices.

Compliance

The Assistant Vice President, IT Security & Infrastructure shall ensure compliance with this policy. Data Stewards and Data Custodians shall implement the policy as described above. Violations of this policy may result in disciplinary action, in accordance with Emerson College's Human Resources and/or Student Conduct policies and any additional collective bargaining agreements. Please review HR's Service Center for details regarding Emerson College's disciplinary process, and the Code of Community Standards.

Effective Date

This policy is effective as of April 2nd, 2020.

Exhibits

Exhibit 1: Data Stewards and Areas of Responsibility

The following vice presidents are Data Stewards and are the highest authority for their respective data domains. They are responsible for making and owning decisions regarding data access, policies, and application purchases for their areas. Data Stewards should collaborate with IT to balance data access control with cross-functional needs, adhering to the Principle of Least Privilege.

• Alexandra Socarides, Vice President, Academic Affairs and Provost: Oversees data related to all academic programs, curriculum, faculty resources, student academic records, and institutional research.
• Allison Dawson, Vice President, Institutional Advancement: Manages data related to donors, fundraising, and alumni engagement.
• Brian Basgen, Vice President, Digital and Physical Infrastructure: Responsible for data concerning information technology systems, infrastructure, and security across the College.
• Carolina Avellaneda, Vice President and General Counsel: Oversees data related to legal cases, compliance, and campus safety.
• Christie Anglade, Vice President, Student Affairs: Governs data for student housing, counseling services, student conduct, and wellness programs.
• Jamie Montgomery-Hyde, Interim Vice President, Human Resources & CHRO: Responsible for all human resources data, including compensation, benefits, performance, recruitment, and policies.
• Kelly Devers-Franklin, Vice President, Marketing and Communications: Responsible for data concerning College marketing, public relations, and communications.
• Matt Boyce, Vice President, Enrollment Management: Governs data related to student admissions, financial aid, student accounts, and demographic information.
• Richard Madonna, Vice President, Finance and Chief Financial Officer: Responsible for data concerning College finances, budgets, procurement, and administrative services.
• Shaya Gregory Poku, Vice President, Community, Culture, & Belonging: Oversees data related to institutional efforts to strengthen the Emerson experience and advance the College’s values.
   

Exhibit 2: Data Custodians and Functional Areas

Data Custodians are College officials and their staff who have operational-level responsibility for data capture, data maintenance, and data dissemination. Data Stewards designate Data Custodians by functional area and data area. New designees must be submitted in writing to the Assistant Vice President, IT Security & Infrastructure, who is the Responsible Officer for this Policy, and must specify the Data Custodian by title and describe the functional and data areas for which the Data Custodian is responsible.

Exhibit 3: Data Classification Guideline and Data Transmittal and Storage Requirements

The table below lists the categories of data and examples. Any data that falls into multiple categories should be considered of the higher security category for protection purposes. If you have questions about a data classification, contact your Department Records Officer or the Director of Information Security and IT Infrastructure.

Data Transmittal and Storage

All members of the Emerson College community and its working partners are responsible for the proper handling, transmittal, and storage of College Data. All individuals and departments must follow the policies and procedures of the College to ensure that data is protected and used properly. Any partner, consultant, or vendor that needs access to or shares any non-public College Data must sign a Third Party Data Security Agreement.