1. EDUCAUSE Seminars in Academic Computing Executive Leadership Seminar Aug. 3-5, 2007 Beth Cate, Associate General Counsel, Indiana University

2. Data Privacy and Security Managing Risk

3. Managing risk generally requires the exercise of control…which can be thin on the ground in our environment!

4. Control?  Our roles are expanding and our operations are becoming more complex Educators, researchers, housing providers, health care providers, lenders, engines of economic growth, entertainment brokers, state resource banks More collaboration with other institutions and with private industry

5. Control?  Awash in data—students, personnel, research subjects, patients, alums, donors, vendors/contractors, external partners Sensitive personal information woven throughout these data  New roles and initiatives prompt new ideas for using and sharing data internally

6. Control?  Often decentralized environment for data creation and management To some extent, in schools’ DNA RCM and similar budget approaches  Not always the same level of critical thought about what data is being collected, maintained, used  Not always the same level of skill or knowledge in handling data

7. Control?  Resource constraints create incentives to aggregate and share data – both internally and externally Internal efficiencies Outsourcing Enhancement of alumni and foundation functions

8. Control?  External requests/demands for data Law enforcement Government regulators Members of the public/oversight organizations Litigants  Constituent expectations that we will oppose some of these requests

9. Control?  Increasingly complex legal landscape with respect to privacy and security of personal information within institutional data In absence of federal standards in some areas, states fill in gaps – 50 state standards to confront Contractual obligations too, e.g. PCIDSS Litigation

10. Control?  Legal standards will be influenced to some extent by what government and industry are doing in the areas of privacy and security (others with greater resources….) Privacy Officers and offices Authentication/identity management Encryption

11. Control?  Not just the law we need to be thinking about but our constituents’ expectations Public discourse on privacy/security doesn’t always take into account competing values and needs

12. So we just need to figure out…  How to design and carry out operations in a way that lets institutions pursue their operational goals while minimizing risk of legal, ethical, and PR problems  How to parse what are/are not IT issues and to deal effectively with the “human agency” factors  How to help set appropriate expectations about data privacy and security