Effective: October 14, 2005
Updated/Revised: April 15, 2008
Contact: Controller's Department

Introduction

Iowa State University recognizes that it collects and maintains confidential information relating to its students, employees, and individuals associated with the University and is committed to maintaining the privacy and confidentiality of an individual's Social Security Number (SSN). This policy applies to all individuals and University organizational units that have access to, collect, or use an individual's SSN.

Policy Statement

University ID shall replace SSN as the primary identifier used by the university. The university will discontinue the use of SSN as the primary identifier. Therefore, the use of SSN as an identification number within the university shall be limited as permitted by law.

To protect the privacy of persons whose SSN is collected, all university offices will follow procedures maintained by the policy administrator and managed by university-designated data stewards. These procedures were to be implemented by June 30, 2007, with requests for extensions of time to implement to be directed to the Policy Administrator prior to that date.

Persons responsible for breaching the privacy of another person by improperly obtaining, using or disclosing a SSN are subject to discipline as provided in the applicable faculty and staff handbooks or collective bargaining agreement and the Student Disciplinary Regulations.

The following rules of conduct apply:

• Employees and students shall comply with the provisions of this policy as well as related institutional policies and procedures.
• Employees may not request disclosure of a SSN from an individual if it is not necessary for the purposes of the university and the particular function for which the employee is responsible.
• Employees and students shall not disclose the SSN of another person to unauthorized persons or entities.
• Employees and students may not seek out or use the SSN of another person for their own interest or advantage.
• Employees responsible for the maintenance of records containing SSNs shall observe all institutionally-established administrative, technical, and physical safeguards in order to protect the confidentiality of such records.
• Employees shall report promptly to their supervisor any inappropriate disclosure of a SSN.

If SSNs are inappropriately disclosed and individuals have been put at risk of identity theft or other harm as a result of the disclosure, the Office of University Counsel shall be notified promptly.

Definitions

Primary Identifier

The primary identifier is the unique number used for identification.

University Identification Number

The University Identification Number (University ID or UID) is an assigned number used for the exclusive purpose of identifying those who are affiliated with the university, or those who desire to acquire services or access resources owned or operated by the university. The University ID is displayed as the middle block of 9 digits on the ISUCard.

Data Steward

Data Stewards are university executive officers or their designees who have planning and policy-level responsibilities for data in their functional areas. These data stewards, as a group, are responsible for recommending policies and establishing procedures and guidelines for university-wide data administration activities. Data stewards, as individuals, have management responsibilities for defined segments of the institutional databases such as SSN.

Resources