Talking Stick - November/December 2016 - 53

security authorizations are controlled,
recorded, and maintained, including
how third-party vendors manage their
systems.

to authorities, data subjects, and, if
appropriate, law enforcement. These
procedures must allow for due process
rights of the accused violators.

Internal departmental or
administrative procedures regarding
how privilege levels are assigned can
also be included in this category. For
example, student staff may be allowed
an access level that grants them
access to some student information
necessary to their job (i.e., viewing
room rosters and inputting conduct
information) but stops them short of
protected personal data unnecessary
to perform job functions (i.e., viewing
the student's grade point average or
conduct sanction information) and
keeps them from being able to change
any information.

Being accountable to these
ethical concerns can be addressed
through an annual departmental
review with smaller periodic reviews
of specific datasets scheduled to
assess that policies and procedures
meet the needs and spirit of fair
information practice principles and
are incorporated into data collection.
It may be helpful for residence life
professionals to consider personal

information within the databases in
the way they think of keys or cards
relating to building security. A small
thing opens the door to much more.
How often are key audits done to
avoid security breaches? What would
be an equivalent protocol for data?
When conducting an audit, the review
should include questions about topics
such as what personal information
the database stores. If it needs to be
collected, who has access to the data,
and can the same task be achieved
with less information?
Finally, staff working with

Security policies and procedures
are broad in scope and include
hardware systems, software systems,
data storage, misuse policies, and due
process procedures. Residence life
professionals should review electronic
data collection and storage procedures
to ensure that there are components
that enhance both privacy and security
(e.g., password protection, encryption
options, technologies of anonymity
or pseudo-anonymity, digital
signatures, and so on). Electronic
security measures are dynamic and
require regular review and update.
Reviews are the shared responsibility
of institutional technology areas and
individual departments, including
housing departments. Third-party
vendors must be responsible for these
policies, and contract language should
indicate accountability to university
standards.
Additionally, residence life
professionals will want to confirm that
documented policies and procedures
exist for user accounts, access rights,
and security authorizations. When
breaches of security or confidentiality
occur, by accident or intentionally, the
security procedures should define how
to communicate security violations
NOVEMBER + DECEMBER 2016

53
http://www.towersurfaces.com/9-solutions http://towersurfaces.com/showers
Talking Stick - November/December 2016

Table of Contents for the Digital Edition of Talking Stick - November/December 2016
