Higher Education Initiatives(with tips for your implementation!)

Merri Beth LavagninoChief Privacy Officer and Compliance Coordinator

Indiana University

Why Should Higher Ed Do It?• Leverage all this infrastructure while you

can• Build awareness of privacy issues in our

communities– We have access to employees, young adult

students, middle age students, retiree alumni…– So our privacy topics range from institutional

adoption of Fair Information Practices, to individual behaviors that impact privacy in settings such as social media or online commerce…

2

How?

• Do at least one little thing this year

• Tie it to something you are doing (or have been meaning to do) anyway!

• Commit to do something every year

• Go for Good Enough – there will never be resources to go all out! 3

Let’s Start at the Very Beginning

• Determine budget• Determine capacity

4

Two Methods

5

Focus• Consider basing on risk

– Free shredding when we were worried about boxes of old records (2008)

• Target an audience– We focus on employees, but within that, may focus

on IT staff, “average” employee, or those that handle sensitive data (2009)

• Promote a message or tool– Monopoly theme used when we were promoting a

new site license for whole disk encryption (2010)– New policy announced on Web Site Privacy Notices

(2011)6

• It’s really ok to just go for it, without a master plan!!• Honor thy colleagues • Use NCSA, FTC, IAPP, & EDUCAUSE

— IAPP www.privacyassociation.org— Host your local IAPP Privacy After Hours (2010)

• Use local (free!) people (2010, 2011)7

EDUCAUSE Resources• EDUCAUSE resource pages: – www.educause.edu/policy/dataprivacy– www.educause.edu/Resources/Browse/Pri

vacy/16915

• Use their graphic on your website• Link it to your data privacy

resource page or to EDUCAUSE’s• Use their text to write messages

you distribute through all your outlets 8

EDUCAUSE Themes• Week 1: Global Data Protection

(connecting to Data Privacy Day, January 28)

• Week 2: Organizational Perspective• Week 3: Relationship Between

Privacy and Security• Week 4: Protection of Personal Data

(Personal Perspective)9

EDUCAUSE Free Webinars• January 10, 3:00–4:00 p.m. (ET)—Privacy and Security

Risks in Higher Education• January 25, 1:00–2:00 p.m. (ET)—A Balancing Act:

Student Privacy and Student Data in the Electronic Age• January 30, 1:00–2:00 p.m. (ET)—Protecting Personal

Data: What Every Student Needs to Know About Online Reputation Management

• Twitter hashtags for webinars: #dataprivacy and #EDUpolicy10

Facebook, Blogs & Tweets• “Like” NCSA Facebook Page– http://www.facebook.com/DataPrivacyNCSA

• Blogs by EDUCAUSE:– http://

www.educause.edu/blog/vvogel/JanuaryisDataPrivacyMonthFreeW/242852

• Twitter:– Follow @EDUCAUSE, @HEISCouncil, and

@DataPrivacyDay– NOTE: Retweeting is incredibly simple…see me

do it at MerriBethatIU! 11

Examples from Higher Ed

• Dalhousie University– http://its.dal.ca/depts/security/events/dpd12/index.html

• University of Washington– http://ciso.washington.edu/events/

• Indiana University– https://protect.iu.edu/privacy/dataprivacyday

12

Now Let’s Retake that Poll!In the meantime, more ideas … •Host a movie with a privacy theme•Post to electronic news screens in public areas of buildings•Send postcards to employees•Make bulletin board kits and distribute•Make and post posters or banners•Put logo or notice on application log in screens•Submit a student newspaper article•Plan a Faculty brown bag•If you have money, consider “The Privacy Professor’s Security Search #1: At the Office” at http://www.rebeccaherold.com/ •NOTICE: If you are responsible for Privacy in a higher education institution, and are not yet a member of the Higher Ed Chief Privacy Officers group (HE-CPO) please email Valerie Vogel at vvogel@educause.edu to join!

13