Guidelines, Standards and Laws

Description

Level 1 Confidential Data is information maintained by the University that is exempt from disclosure under the provisions of the California Public Records Act or other applicable state or federal laws.  Its unauthorized use, access, disclosure, acquisition, modification, loss, or deletion could result in severe damage to the CSU, its students, employees or customers.  Financial loss, damage to the CSU’s reputation and legal action could occur if data is lost, stolen, unlawfully shared or otherwise compromised.

Level 1 data is intended solely for use within the CSU and limited to those with a “business need-to-know.”  Statutes, regulations, other legal obligations or mandates protect much of this information.  Disclosure of Level 1 data to persons outside of the University is governed by specific standards and controls designed to protect the information.

Confidential information must be interpreted in combination with all information contained on the computer or electronic storage device to determine whether a violation has occurred.

Level 1 access will be granted on a strict “need-to-know” basis only and will be restricted to authorized staff and other participants who have executed an approved Non-Disclosure Agreement (NDA).  This information includes organization contact lists, internal processing procedures, employee schedules and other information required to function within the organization but too sensitive to release to the public.

Examples (note: list provides examples and is not all-inclusive)

• Passwords or credentials
• PINs (Personal Identification Numbers)
• Birth date combined with the last four digits of SSN and name
• Credit card numbers with cardholder name or expiration date and/or card verification code
• Tax ID with name
• Driver’s license number, state identification card and other forms of national or international identification (such as passports, visas, etc.) in combination with name
• Social Security number and name
• Health insurance information with name
• Medical records related to an individual
• Psychological counseling records related to an individual
• Bank account or debit card information in combination with any required security code, access code, or password that would permit access to an individual’s financial account
• Electronic or digitized signatures
• Private key (digital certificate)
• Vulnerability/security information related to a campus or system
• Attorney/client communications
• Legal investigations conducted by the University
• Third-party propriety information per contractual agreement
• Sealed bids
• Employee name with personally identifiable employee information
  • Biometric information
  • Electronic or digitized signatures
  • Personal characteristics

Description

Internal use data is information that must be protected due to proprietary, ethical or privacy considerations.  Although not specifically protected by statute, regulations or other legal obligations or mandates, unauthorized use, access, disclosure, acquisition, modification, loss or deletion of information at this level could cause financial loss, damage to cause financial loss, damage to the CSU’s reputation, violate an individual’s privacy rights or make legal action necessary.

Non-directory educational information may not be released except under certain prescribed conditions.

Level 2 access will be granted on a strict “need-to-know” basis only and will be restricted to authorized staff and other participants who have executed an approved Non-Disclosure Agreement (NDA).  This information includes organization contact lists, internal processing procedures, employee schedules and other information required to function within the organization but too sensitive to release to the public.

Examples (note: list provides examples and is not all-inclusive)

• Identity Validation Keys (name with)
  • Birth date (full: mm-dd-yy)
  • Birth date (partial: mm-dd only)

• Student name with personally identifiable education records
  • Grades
  • Courses taken
  • Schedule
  • Test scores
  • Advising records
  • Educational services received
  • Disciplinary actions

• Employee Information
  • Employee net salary
  • Employment history
  • Home address
  • Personal telephone numbers (including emergency contacts)
  • Personal e-mail address
  • Payment History
  • Employee evaluations
  • Disciplinary actions
  • Background investigations
  • Mother’s maiden name
  • Race and ethnicity
  • Parents and other family members names
  • Birthplace (city, state, country)
  • Gender
  • Marital Status
  • Physical description
  • Photograph (voluntary for public display)

• Other
  • Donor name, address, phone, email and giving amount
  • Library circulation information
  • Trade secrets or intellectual property such as research activities
  • Location of critical or protected assets
  • Licensed software

Description

This is information that is generally regarded as publicly available.  Information at this level is either explicitly defined as public information or intended to be available to individuals both on and off campus or not specifically classified elsewhere as Level 1 or Level 2.

Knowledge of this information does not expose the CSU to financial loss or jeopardize the security of the CSU’s information assets. 

Publicly available data may still be subject to appropriate campus review or disclosure procedures to mitigate potential risks of inappropriate disclosure.

1Cal State LA may disclose “Directory Information” without prior written consent of the student.  However, at any time the student may exercise the option to consider this information confidential by completing the Releasing Student “Directory Information” to Outside Agencies form and submitting it to the Admissions and Records Center, SSB 1st Floor. All requests to obtain student directory information must be directed to the Admissions and Records Center.

Examples (note: list provides examples and is not all-inclusive)

• Campus Identification Keys
  • Campus identification number
  • User ID (do not list in a public or a large aggregate list where it is not the same as the student email address)
  • Email
• Student Information1

Educational directory information (FERPA) includes

• Name
• Address
• Telephone number
• Email address
• Photograph
• Major field of study
• Participation in officially recognized activities and sports
• Height and weight of members of athletic teams
• Dates of attendance
• Grade level
• Enrollment status
• Degrees, honors and awards received
• Most recent previous educational agency or institution attended by the student

Bargaining unit student employee directory information

• Name of the department employing the student
• The student employee’s telephone number within the department
• The student employee’s email address within the department
• The student employee’s job classification

• Employee Information (including student employees)
  • Employee title
  • Status as student employee (such as TA, GA, ISA)
  • Employee campus email address
  • Employee work location and telephone number
  • Employing department
  • Employee classification
  • Employee gross salary
  • Name (first, middle, last) (except when associated with protected data)
  • Signature (non-electronic)
• Donor Information
  • Constituent code
  • Class, degree, academic organization, major
  • Employment information defined above
  • Job title