When SCSU maintains data about an individual, that individual is a data subject. Data subjects have certain rights regarding that data. Members of the public also have rights to access SCSU-maintained data classified as public. Data includes recorded information such as paper documents, email, DVDs, photographs, et cetera. Data on individuals are classified by state law as public, private, or confidential. The MGDPA presumes that all government data are public unless a state or federal law dictates otherwise. SCSU must keep all government data in a way that is easy to access and may only collect and keep those data that are needed for administering and managing programs that are permitted by law.
Public data
Access to public data must be given to anyone who asks; it does not matter who is asking for the data or why. An example of public data is directory information such as a student’s name or major. State employee salary is also considered public data.
Private data
Access to private data will not be granted to the general public, but data subjects have access when the data are about them. Private data will only be shared with the data subject, with a third party who has been authorized by the data subject to access the data, with staff who need the data to do their work, and as permitted by law or court order. A social security number or what life insurance coverage an employee selected for their benefits package are examples of private data.
Confidential data
Confidential data have the most protection. Neither the public nor the data subject can access these data. Confidential data must only be accessed by staff who need the data to do their work and to others as permitted by law or court order. Revealing the identity of the subject of an active criminal investigation, for example, is prohibited under this protection
Data Subject
If the data or information identifies an individual or is about an individual, then that individual is the data subject. Data subjects have the right to:
Access to Data
Data subjects have the right to be informed about what types of data are maintained about them and be given access to look at and/or be provided with copies of these data upon request. They may also request that the information be provided to someone else by using the data release consent form. If the data subject is an SCSU student, FERPA rights belong to the student, even if the student is under age 18. SCSU requires the student’s written consent before releasing education records to a parent or legal guardian, unless an exception under FERPA or other applicable law permits disclosure. If a data subject is under the age of 18 and not attending SCSU, a parent or legally appointed guardian may look at or get copies of these data without consent. Charges for copies may apply.
Notice of Data Collection
When an individual is asked to provide private or confidential data about themselves, they will be provided with a notice that is sometimes called a Tennessen warning. This notice controls how SCSU may use and release the data provided. SCSU will obtain the data subject’s written informed consent if the data need to be used or released in a different way, or if the data subject wishes for SCSU to release the data to a third party.
Safeguarding of Data
SCSU has established appropriate safeguards to ensure that all private and confidential data are safe. In the unfortunate event that SCSU determines a security breach has occurred and an unauthorized person has gained access to private or confidential data, SCSU will notify the impacted individuals as required by law. (See Related Policies)
Challenge to Accuracy or Completeness of Public and Private Data
Data subjects may challenge data that they believe is incorrect or incomplete and have the right to appeal decisions that SCSU has made about their data.
Student Directory Information
Directory information is Educational Data that would not generally be considered harmful or an invasion of privacy if disclosed. For more information see supporting URL’s.
SCSU designates the following Educational Data on students as Directory Information:
- Name
- Most recent previous educational institutions attended
- Enrollment status
- Class level
- Major field/program of study
- Dates of attendance
- Degrees and dates awarded
- Honors/awards/scholarships and date awarded
- Weight, height, and performance records of athletic team members
- Participation in official recognized activities and sports, and applicable participation dates
Limited Directory Information
SCSU has adopted a Limited Directory information policy, as allowed by FERPA. This means SCSU will limit to whom, and the purposes for which, the listed limited directory data are disclosed—unless a restriction has been placed.
SCSU designates the following Educational Data on students as Limited Directory Information for disclosure to specific parties, for specific purposes, or both:
- Student email addresses, Tech IDs, and Star IDs for enterprise technology related purposes internal to Minnesota State that are approved by system office information technology in writing.
- Student email addresses, and Star IDs for the purposes of inclusion in a directory accessible to Minnesota State students and employees.
- Student email addresses, physical addresses, and telephone numbers for sharing with college and university foundations.
- Student email address for sharing with recognized statewide student associations.
- Student’s physical address in institution owned housing for sharing with county auditors for voter registration purposes in accordance with Minn. Stat. § 135A.17, Subd. 2.
- Student images and likenesses for the use in official Minnesota State publications and broadcasts (digital or print).
- Student physical address, email address, and telephone number for sharing between and among the Minnesota State colleges and universities for the benefit of the students, including, but not limited to, informing Minnesota State college students of scholarship and educational opportunities at Minnesota State universities or informing Minnesota State university students of scholarship and educational opportunities at Minnesota State colleges.
- Student hometown for purposes of college or university publications.
- Honors and dates awarded for employment verification.
- Other Educational Data for sharing between and among the Minnesota State colleges and universities for purposes approved in writing by the Senior Vice Chancellor of Academic and Student Affairs, or their designee.
- Student physical address for sharing with the United States Census Bureau as part of the decennial census.
Suppression of Directory and Limited Directory Information
If a student does not wish for SCSU to release Directory Information or Limited Directory Information about the student without the student’s written consent, the student must notify the university in writing. Any such directive will be in place until the student in question withdraws it in writing. A student may either suppress all Directory and Limited Directory Information or none.
Member of the Public
If a member of the public is not the data subject, they have the right to:
- Access public data:
- A member of the public may look at or request copies of any public data. SCSU has, however, designated certain student data (see supporting URLs) as limited directory data as allowed by FERPA, and will only release this information to the SCSU Foundation and/or to parties contractually affiliated with SCSU. Charges for research and copies may apply.
- Request summary data:
- Summary data are statistical records or reports that are prepared by removing all identifiers from private or confidential data on individuals. The preparation of summary data is not a means to gain access to private or confidential data. SCSU will prepare summary data if a request is made in writing and the cost of researching and creating the summary data is prepaid.