1. © 2003, EDUCAUSE Information Privacy: Public Policy and Institutional Policies Rodney J. Petersen Policy Analyst, EDUCAUSE EDUCAUSE/Internet2 Security Task Force Coordinator Wendy Wigen Policy Analyst, EDUCAUSE

2. Information Privacy Information ~ data and personally identifiable Collection Storage Use Dissemination Privacy ~ loss of freedom Volume of information compiled about individuals without their knowledge Unauthorized access to information in computerized databases Electronic surveillance

3. Cyber Security - Public Policy Recent Legislation & Regulations HIPAA – Security Regulations Gramm-Leach-Bliley Act Safeguard Rules Proposed Legislation S. 1350 Notification of Risk to Personal Data Act Prospects for Future Developments Info Security Governance & Accountability

4. Cyber Security - Implications Campus Policy Issues: Designate employee(s) to coordinate Conduct a risk assessment Inventory Assets Identify reasonably foreseeable risks Assess the sufficiency of safeguards in place to control these risks Design and implement safeguards to control the risks you identified through risk assessment Regularly test and monitor the effectiveness of the safeguards Procedural Issues: Confidentiality and Nondisclosure Breach notification Logging and monitoring Identification of departmental contacts Blocking network access Incident response Education & Awareness: Train Personnel Inform Users of Safeguards Raise Awareness 3 rd Party Services

5. Identity Theft – Public Policy Fair and Accurate Credit Transactions Act – Signed December 4 Will serve as model for privacy/ID theft Incorporates most Identity Theft proposals Prevention: SSN’s Credit Card truncation and red alerts i.e. address change/new card Victim Assistance: rights and education Enforcement: coordination and improved technology

6. Identity Theft - Implications Eliminate use of Social Security numbers as primary identifiers Identity Management Identity Theft Awareness & Resources

7. Privacy Policies – Public Policy Legislation & Regulations Family Education Rights & Privacy Act Maryland Data Security & Privacy Policies HIPAA – Security Regulations Proposed Legislation Interagency Proposal to Consider Alternative Forms of Privacy Notices Under the Gramm-Leach- Bliley Act Prospects for Future Developments Notices that are useful & more readable Balancing “compliance” with “ethical” standards

8. Privacy Policies - Implications Complicated in large, decentralized academic institutions Collection and Disclosure of Personal Information Application to “paper” as well as “electronic” practices Training, Oversight, and Advocacy

9. SPAM – Public Policy CAN-SPAM Act: signed December 15 Work in progress: main goals Establish a National Law/ work toward an International agreement Target egregious spammers/ enable law enforcement Protect legitimate e-marketing/ establish standards

10. SPAM - Implications Referral of user complaints State Attorney General’s Office Department of Justice Federal Trade Commission Institutions pursuit of damages Acceptable Use Policy/Terms of Service Use of SPAM Filtering Software

11. USA PATRIOT Act – Public Policy SAFE Act ( Security and Freedom Ensured ) and Protecting the Rights of Individuals Act Addresses: Improved oversight of FBI/DoJ Expanded sunset provisions-demand review for renewal Restores pre-PATRIOT standards for search warrants Clarifies delayed notice or “Sneak and Peek” searches Exempts Libraries/booksellers from National Security Authorities (NSL’s) Strong counterbalance to DoJ/ signals awareness in Congress

12. USA PATRIOT Act – Implications Responding to Law Enforcement Requests Voluntary Disclosure of Information Logging and Monitoring Training of Personnel Notification to Users

13. For more information: EDUCAUSE D.C. Office http://www.educause.edu/policy (202)872.4200 rpetersen@educause.edu wwigen@educause.edu