Storage of Protected Personal Data on Mobile Media and Devices

The College of Saint Benedict/Order of Saint Benedict have a responsibility to protect the personal data of its students and employees. To that end, a significant investment in hardware, software, security policies and practices, along with external security audits has been employed to safeguard this data.  Nevertheless, the most common method of losing confidential data is by loss or theft of mobile devices or media that had protected data stored on them.  (Data that is used for identity theft and other illegal purposes is characterized as “protected” data.)   Therefore, we are making the following policy effective immediately:

Storage of Protected Personal Data on Mobile Media and Devices

Federal and State Laws, most notably the Family Educational Rights and Privacy Act (FERPA), require that maximum efforts be enlisted at all times to protect the privacy of student educational records.  Similar laws are designed to protect the privacy and confidentiality of employees.

Because of the extreme vulnerability of mobile computer hardware (theft, damage, loss, etc., ) all information of this nature including student educational records and any information of a private or confidential nature relating to employees, especially those containing personal identifiers, should only be stored on network drives.   At CSB/OSB end user network drive designations are defined as your home directory “M: drive” and department shares “O: drive”.  FERPA protected data should never reside on mobile computer hardware or other storage media (e.g. external hard drive, flash drives, floppies, CD's, Zip disks, etc.). 

FERPA protected data has been defined as any file that contains a combination of NAME and one of the following:

Social Security number
CSB/OSB Student ID number
Birth date
Grades/GPA
Race/ethnicity
Gender
Country of citizenship
Religion