Privacy Prompts for Team Meetings “Extra Credit”

Want extra credit? Start making privacy a priority! Check out these privacy prompts to bring to your next staff or working group meeting!

These questions build on each other. Consider taking 10 minutes per staff meeting and discuss one per month during the coming year, or just pick one if that’s all the time your team has!

1. What’s the difference between privacy and security?
2. Do we know what data we have and where it lives?
3. Do we know for what purposes we acquire and retain data or are we just on autopilot, collecting what we have always collected? Is there any data we collect that we don’t really need?
4. What data retention schedules apply to our data? Do we have a process to delete data when retention is met? What challenges does deletion cause for our unit? What challenges does keeping past retention cause?
5. Do we understand data classification at UW? What sensitive or restricted data do we have? Do we know where our most high-risk data resides?
6. Do we control access to our high-risk data? How?
7. Do we commonly use any e-tools that have not gone through a security and privacy review? What are they? Are there enterprise tools that we could use instead?
8. What does a breach look like in our unit? Do we know who to notify in the event of a breach?
9. What training or resources have we received or are we familiar with related to data privacy? What additional training or resources would be useful?
10. Have a team discussion of a use case. These scenarios were drafted by the Institutional Data Stewards about data in their domain, so pick the one that makes the most sense for your team. The point of this exercise is to develop an answer beyond simply “no!” but rather “Don’t do that because <insert specific reasons and rationales>.”
    1. A colleague approaches you because they want to surprise an office mate by sending a birthday card to their house and asks: “You have access to HRS, could you look up their personal home address for me?”
    2. I’ve just received grant funding to launch a new program in my department for under-represented women in STEM. Could you generate a list of students with their sex and race and ethnicity so I can reach out to them about this new opportunity.
    3. Since you already have access to a restricted dataset in RADAR, could you save me some time and pull that down and share it with me. I don’t have time to go through the access request process.
    4. My research involves the impact of COVID on learners. Could you share some of the data about students in your class interacting with Canvas between 2020-2022. I would like to include it in my research.
    5. I’ve got this aggregated dataset about the overall number of students who used our service in the last year. However, I’d really like to get the row-level data to better understand what’s going on here.
    6. I’m an instructor and I want to use this online tool that my students have to sign up for. It’s great because it’s free!
11. A Geographic Information Systems student approaches you and asks: I’m looking for cool data to visualize in my class on GIS analysis techniques. Since you work in Facilities Planning & Management, could you get me a copy of the building and utility layers for our campus?
    How does data protection (through privacy and security principles) benefit us as employees and as data subjects?

Did your team get through all of these? Contact Claire Dalle Molle in the Office of Compliance for your Privacy Champion Certificate!