NUMBER: ACAF 7.02
SECTION: Academic Affairs
SUBJECT: Data Access
DATE: February 1, 1995
LATEST REVISION: March 3, 2004
Policy for: All Campuses
Procedure for: All Campuses
Authorized by: Jerome D. Odom
Issued by: Provost's Office
________________________________________________________________
1. Policy
Information maintained by the University is a vital asset that will be available to all employees who have a legitimate need for it, consistent with the University's responsibility to preserve and protect such information by all appropriate means. The University is the owner of all administrative data; individual units or departments may have stewardship responsibilities for portions of that data. The University intends that the volume of freely accessible data be as great as possible. While recognizing the University’s responsibility toward the security of data, the procedures established to protect the data must not unduly interfere with the efficient conduct of University business. Unjustified barriers to accessing computerized institutional data must be avoided.
The value of data as an institutional resource is increased through its widespread and appropriate use; its value is diminished through misuse, misinterpretation, or unnecessary restrictions to its access. The University expressly forbids the use of administrative data for anything but the conduct of University business. Employees accessing data must observe requirements for confidentiality and privacy, must comply with protection and control procedures, and must accurately present the data in any use.
The University determines levels of access to administrative data according to principles drawn from various sources. State and federal law provides clear description of some types of information to which access must be restricted. In an academic community, ethical considerations are another important factor in determining access to administrative data.
This policy is for the internal use of information for employees at the University of South Carolina. External requests for information are handled in accordance with University Policy HR 1.00 "Freedom of Information Policy."
2. Definition of Administrative DataThe University's database consists of information critical to the success of the University as a whole. The University database is shared data, managed within a conceptual framework. It is likely that the University database will be distributed across processing units within the University.
Data may be stored on paper or as digital text, graphics, images, sound, or video. The University regards data that are maintained in support of a functional unit's operation as part of the University's administrative database to be official data if they meet any of the following criteria:
Some examples of administrative data include student course grades, employee salary information, vendor payments, and the University's annual Fact Book. Administrative data do not include personal electronic calendar information and similar material.
Copies of official data are NOT official data where they are found on diskettes, individual hard drives, network servers, or as files on other shared systems. These copies or downloads cannot be used as substitutes for official records kept by the authorized data stewards of the University. However, such information may be used to generate official reports on behalf of the University with the knowledge and permission of the data stewards. Such files and any resulting reports are covered by the same constraints of confidentiality and privacy as the official records.
Prior to the development of a system that will download official records and manipulate them for subsequent update or application to official records, permission must be obtained from the data steward for such transfer.
3. Data Trustees, Data Stewards and Data UsersData Trustees are senior management personnel (typically at the level of Vice President, Associate or Vice Provost, Dean, or University Director) who have planning and policy-making responsibilities for data in their operational area. The Data Trustees, as a group, are responsible for overseeing the establishment of data management policies and procedures.
Data Stewards are managers of functional areas (typically at the level of Controller, Registrar, Director of Admissions or Director of Administrative Information Services) who oversee the capture, maintenance, and dissemination of data for a particular operation. Data Stewards are responsible for making security decisions regarding access to the data under their charge. Data Steward responsibilities include the data management activities outlined in this policy and other activities that may be delegated by a Data Trustee.
Data Users are individuals who access University data in order to perform their assigned duties or to fulfill their role in the University community. Data Users are responsible for protecting their access privileges and for proper use of the University data they access (see Responsibilities of Users).
4. Responsibilities of Data Trustees, Data Stewards, and Computer Services
4.1 Categorization of Data
Data Trustees will assign each item of administrative data and each standard view
of that data to one of three categories: general access, limited-access, or restricted.
4.1.1 General Access Data
General access data are all data that are not either restricted or judged by Data
Trustees to be limited-access data. The accessible data volume should be as great as possible to enable those who need the
information to have access. Data should be part of an open atmosphere and broadly available. General Access data are subject to disclosure to all USC employees as well as the general public under the Freedom of
Information Act. Limited access data are data that the Data Trustees judge to require special
procedures for access. Limited access data may be subject to disclosure under the Freedom of Information Act.
Limited access data are made available to a select group of USC employees based on their job function. Restricted data are those data found upon review by the Data Trustees or
General Counsel to require restrictions on access. Restricted data may not be subject to disclosure under the
Freedom of Information Act. Restricted data are only available to USC employees that have a business or
educational need to access the data. Data Stewards are ultimately responsible for assigning access to all types of
data on an individual basis; however, general criteria for determining access to both restricted and limited access
data include the following: HR/Payroll data can be made available as follows: Financial data can be made available as follows: Student data can be made available as follows: The Data Trustees and Stewards will establish procedures for initial definition
and change of data elements within their data entity. Data Stewards will provide data descriptions for directories that will let data users know what shareable data are
available, what the data mean, and how to access the data. Data definitions will be: The Data Trustees will work with Data Stewards and data users to define useful
and meaningful schedules for creation of standard data extracts (data snapshots that are captured at a fixed point
in time). The Data Trustees will work with the Data Stewards to define standard views of administrative data, in order to
aggregate data from multiple sources, to segment data into smaller and more manageable subsets, or to segregate data
according to confidentiality or similar characteristics. A data view is a logical entity only, typically assembled
from the most current data from their primary storage location at the time they are requested. The term "access" means to read or view administrative data. Access does not
include the ability to create or modify data. Creation and modification can only be done by the Data Steward, the Data
Trustee, or their designate. Each Data Steward will be individually responsible for establishing data access procedures that are unique to a
specific information resource or set of data elements. These procedures will ease access and will ensure data
security. Data Trustees will develop policy to promote the accurate interpretation and
responsible use of administrative data. Data Stewards are responsible for making known the rules and conditions that could affect the accurate presentation
of data. Persons who access data are responsible for the accurate presentation of that data. Data Stewards will support users in the use and interpretation of administrative data, primarily through documentation,
but also in the form of consulting services. The Data Stewards will determine the most reliable sources of data and
regularly evaluate the quality of the data entity. They will determine responsibilities for data capture and
maintenance to ensure data integrity. The Data Stewards will identify gaps and redundancies in the data and, to the extent possible, will ensure
that only needed versions of each data element exist. They will specify data control and protection requirements
to be observed by data processors and users. The Data Stewards will monitor the data for accuracy, integrity, and dependability, and where appropriate, will
initiate action concerning these issues. The Data Trustees, in consultation with Computer Services, will determine
security requirements for administrative data and will be responsible for monitoring and reviewing security
implementation and authorized access. The Data Trustees and Stewards will define the criteria for archiving the data
to satisfy retention requirements. Computer Services is ultimately responsible for defining and implementing
policies and procedures to assure that data are backed up and recoverable. The Data Trustees will play an active
role in assisting Computer Services in this responsibility. With the Data Trustees' advice, Computer Services will develop a workable plan for resuming operations in the
event of a disaster, including recovery of data and restoration of needed computer hardware and software. Administrative Information Services (AIS) develops and applies standards
for the management of institutional data and for ensuring that data are accessible to those who need it. AIS works with the Data Trustees to establish long-term direction for effectively using information resources
to support University goals and objectives. AIS creates logical data models of applications. These models are ultimately used to create an institution-wide
data model that cross-references data across applications and encourages data sharing. AIS develops a standard method for naming and defining data. It also facilitates conflict resolution in data
definitions. AIS makes institutional data available to authorized users in a manner consistent with established data access
rules and decisions. It develops views of data as directed by the Data Trustees and Data Stewards. The group ensures
that the technical integrity of the data is maintained and that data security requirements are met.
5.1 Restricted or Limited-Access Data
Access to restricted or limited-access data by University employees or
employees of University-related foundations requires that a formal request be made to the appropriate Data Steward. All requests for exceptions to data access policies must be made in writing
to the Data Steward. E-mail requests are acceptable. The request must specify the data desired and their intended use. The Data Steward must provide a written record of the reasons for denial
of any access request. E-mail records are acceptable.
6.1 Use of administrative data only in the conduct of University business
The University expressly forbids the disclosure of unpublished
administrative data or the distribution of such data in any medium, except as required by an employee's
job responsibilities and approved in advance by the Data Steward. In this context, disclosure means giving
the data to persons not previously authorized to have access to it. The University also forbids the access or
use of any administrative data for one's own personal gain or profit, for the personal gain or profit of others,
or to satisfy personal curiosity. Users agree to use the information only as described in the request
for data access. Users will respect the confidentiality and privacy of individuals
whose records they access, observe any ethical restrictions that apply to data to which they have access, and
abide by applicable laws and policies with respect to access, use, or disclosure of information. All data users
having access to restricted or limited-access data will formally acknowledge (by signed statement or some other means)
their understanding of the level of access provided and their responsibility to maintain the confidentiality of data
they access. Each data user will be responsible for the consequences of any misuse. Users are expressly prohibited from
releasing identifiable information to any third party. Users will comply with all reasonable protection and control procedures for
administrative data to which they have been granted access. Users will be responsible for the accurate presentation of administrative
data, and will be responsible for the consequences of any intentional misrepresentation of that data. The Office of Institutional Planning and Assessment shall be the University's clearinghouse for official reports
to external agencies including federal and state governments. All levels of management are responsible for ensuring that all data users
within their area of accountability are aware of their responsibilities as defined in this policy. Specifically,
managers are responsible for validating the access requirements of their staff according to their job functions,
and for insuring a secure office environment. The head of each unit will authenticate the need for individual access
to data and must request and obtain authorization for access to data from the steward of such data. Administrative and academic unit heads are responsible for taking the necessary steps to ensure that data
access is terminated for employees who transfer to another department within the University or leave employment
of the University. [Please see University Policy ACAF 7.02.]
8. Appendix B – Data Stewards
9. Appendix C - Itemization of University Data
9.1 General Access
9.1.1 Data Available from University of South Carolina Fact Book
General Information University Enrollment Columbia Campus Four Year and Regional Campuses Financial Report - System, Regional Campuses, and Medical School NOTE: This information is not available to anyone who does not have an
educational need to know (defined in section 4.1.4) if the student has completed a request for privacy as outlined
in the Notification of Student Rights Under FERPA which is published in the University catalogs, the Master
Schedule of Classes, and the Carolina Community.
9.2.1 Human Resources/Payroll Data
Restricted Limited Access Personal Nature: Personal Nature: Performance Basic Information: Basic Information: Basic Faculty Data:
9.2.2 Student Data
Restricted Limited Access Personally identifiable student data not designated as Directory Information: Faculty Instruction Data
9.2.3 Financial Data Restricted Limited Access
Download the Appendix D as shown below - Statement of User Responsibility in pdf.
_______________________________________
10. Appendix D – Statement of User Responsibility I understand that by virtue of my employment with the University of South Carolina, I may have access to data,
information, systems, or files in various forms which contain individually identifiable information, the disclosure
of which may be prohibited by federal or state law or by University policy. I acknowledge that the intentional
disclosure by me of this information to any person could subject me to criminal and civil penalties imposed by law.
I further acknowledge that such willful or unauthorized disclosure may also violate University of South Carolina
policy and could constitute just cause for disciplinary action including termination of my employment on the first
offense regardless of whether criminal or civil penalties are imposed. If I am in doubt about a request, I will consult with my supervisor prior to releasing the information. My signature denotes that I have read and understand the above statement. _______________________________________ ____________ Signature of Employee Date _______________________________________ ____________ Signature of Supervisor Date
{A school official is a person employed by the University in an administrative, supervisory, academic or research, or
support staff position; a person or company with whom the University has contracted (such as an attorney, auditor, or
collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a
disciplinary or grievance committee, or assisting another school official in performing his or her tasks.}
A school official has a legitimate educational interest if the official needs to review an
educational record in order to fulfill his or her professional responsibility.
4.2 Definition of Data
4.3 Definition of Data Extracts and Data Views
University of South Carolina
Data Trustees
Payroll Data
Vice President and Chief Financial Officer
Financial Data
Vice President and Chief Financial Officer
Facilities Data
Vice President and Chief Financial Officer
Human Resources Data
Vice President for Human Resources
Library Data
Dean of Libraries
Development Data
Vice President for University Advancement
Admissions Data -
Graduate, Law, Medicine
Executive Vice President for Academic Affairs and Provost
Admissions Data - Undergraduate
Vice President for Student Affairs
Alumni Data
Vice President for University Advancement
Financial Aid Data
Vice President for Student Affairs
Student Data
Executive Vice President for Academic Affairs and Provost
Student Medical Data
Student Counseling Data
Student Housing Data
Student Discipline Data
Vice President for Student Affairs
Student Advisement Data
Executive Vice President for Academic Affairs and Provost
Course Data
Executive Vice President for Academic Affairs and Provost
Faculty Data
Executive Vice President for Academic Affairs and Provost
Communications Data
Vice President and Chief Financial Officer
University of South Carolina
Data Stewards
Financial Data
Payroll Data
Controller
Director of Accounting Services
Director of Financial Services/Bursar
Budget Director
Assistant to the Vice President for Business & Finance
Director of Cost and Contract/Grant Accounting
Director of Payroll
Director of Purchasing
Director of Health & Safety
Facilities Data
Director of Facilities Management & University Architect
Human Resources Data
Director of Salary Administration & HR Systems
HRIS Manager
Library Data
Librarian for Administrative Services
Development Data
Senior Director, Advancement Administration
Senior Director, Advancement Services
Admissions Data
Director , Undergraduate Admissions
Director, Graduate Admissions
Assistant Dean of Admissions, Law School
Director of Enrollment Services and Registrar, School of Medicine
Directors of Admissions, Senior and Regional Campuses
Alumni Data
Senior Director, Advancement Administration
Senior Director, Advancement Services
Financial Aid Data
Director, Student Financial Aid and Scholarships
Regional Financial Aid Officers
Student Data
University Registrar
Senior Associate Registrar
Director of Financial Services/Bursar
Director of Housing and Judicial Programs
Director, Student Health Services
Director, Counseling and Human Development Centers
University Archivist
Associate/Assistant Deans/Student Services Coordinators
Department Chairs
Director, Graduate Admissions
Course Data
University Registrar
Senior Associate Registrar
Faculty Instruction Data
University Registrar
Senior Associate Registrar
Communications Data
Director of University Information Systems
9.1.2 Data Available from Financial Schedules
9.1.3 Data Available from Human Resources
9.1.4 Data Available from Student Records
Employee Name - Printed (Last, First)