Principles on Accessing and Using PII at KSU
Please review and acknowledge the Guiding Principles on Access to and Use of Personally
Identifiable Information before completing the Data Request Form.
Guiding Principles on Access to and Use of Personally Identifiable Information (PII)
at KSU
Kennesaw State University (KSU) receives numerous requests from on-campus and off-campus
entities for personally identifiable information (PII) on our students and employees.
PII includes data that are collected and maintained by the University that can be
used to uniquely identify, contact, or locate a single person. PII includes sensitive,
or confidential information associated with an individual person, such as an employee,
student, staff, or donor, and includes email addresses. PII also includes any information
allowing a reasonable person to deduce the identity of an individual. It can include
multiple releases of seemingly de-identified information that can cumulatively create
the likelihood of identifying a specific individual. PII should be accessed only on
a strictly need-to-know basis and handled and stored with care per federal, state,
and institutional guidelines. Campus employees with access to information as an official
job duty are prohibited from use of PII beyond what is required to do their job. Employees
with access as an official job duty are prohibited from allowing access to third parties
and/or distributing survey documents on behalf of third parties. Further restrictions
on access and use of student PII is protected by FERPA.
PII requests directly related to the University’s mission may be approved on a case by case basis. These requests should be provided directly to the Data Steward overseeing the PII data. In these cases, disclosures of PII should be narrowly tailored to fulfill the mission, and should only be pursued if the goals served by the disclosure cannot be served without disclosing the PII data. Information requests directly related to the University’s mission include:
- Information reporting or disclosures to USG;
- Information reporting or disclosures required by federal or state law or regulation
(e.g., required to fulfill federal financial aid requests or reporting, HOPE scholarship
reporting; disclosure required under Freedom of Information Act or Georgia Open Records
Act);
- Information required by a court order or subpoena directed to the University and legally
served;
- Information required by institutional accrediting agencies (e.g., SACSCOC);
- Information authorized by KSU’s participation in a consortium or contract authorized and signed by KSU’s President, Provost, or Vice President for Research and solely as authorized by that agreement (e.g., as a precondition of participating in a research grant);
- Information related to institutional improvement efforts, institutional research, studies, and/or reports relating to KSU’s mission, as authorized by the President, Provost, or his/her designee(s);
- Information disclosures necessary for an employee to perform his/her primary job duties (e.g., academic instruction, Registrar’s Office, Financial Aid, Enrollment Services);
- Other information disclosures related to those above, yet not specifically described,
and as authorized by the President, Provost, or his/her designee(s).
Any University requests for PII data unrelated to KSU’s mission described above require prior written approval of the President or his/her designee. Prior to seeking a request for exception, the survey must have been approved by an Institutional Review Board (IRB), although IRB approval does not ensure survey administration will occur. All other requests for PII should proceed though the appropriate legal processes for accessing data and/or records (e.g., Freedom of Information Act, Georgia Open Records Act). This will ensure equitable treatment of all information requests unrelated to fulfilling the University’s mission, ensure information requests are addressed consistently with the requirements of federal and Georgia law and policy, and ensure KSU students’ tuition and other public funds are not used to subsidize the cost of fulfilling data requests unrelated to the University’s mission that are beyond the costs allowed by law.
Approved April 2020.
|