UNIVERSITY PARK, Pa. — Each year on Jan. 28, Data Privacy Day is held to help create international awareness about the importance of privacy and protecting personal information, to empower individuals to take responsibility for their own privacy, and to encourage organizations to value privacy, safeguard data and enable trust.
The University Privacy Office, part of Penn State’s Office of Information Security, has developed a robust privacy program for Penn State and has a dedicated team focused on privacy considerations.
“The ongoing pandemic, coupled with international news about cybersecurity incidents and data breaches, make it even more imperative that people learn about how to protect their private information, and the private information of others,” said Holly Swires, Penn State’s Chief Privacy Officer.
Being proactive about privacy helps all members of the Penn State community, added Swires.
“The wide scope of services offered by universities like Penn State makes privacy extremely complex and many organizations are realizing the value of putting a privacy program in place to head off problems," she explained. "The University Privacy Office is committed to maintaining a privacy-aware culture at Penn State and to helping faculty, staff and students understand the information they work with and what compliance obligations and regulatory requirements apply.”
The Privacy Office promotes and champions privacy at every stage of the data lifecycle and strives to incorporate privacy into the University’s business processes, contracts, research engagements, compliance obligations, and other data-related decision-making. It also provides oversight and leadership to faculty, staff and students to ensure these procedures are being followed. Through its socialization efforts, the Privacy Office has encouraged units enterprise-wide to be committed to compliance with international, federal, state and local privacy laws and regulations, as well as privacy-centric University policies, standards and guidelines.
The Privacy Office’s mission is to help stakeholders become familiar with how privacy should be managed and the principles that should be adopted according to the University’s Privacy Policy, AD53. In addition to its Privacy Policy, Penn State’s Privacy Principles create a consistent strategy for privacy at Penn State and inform University and business decisions that have privacy implications. The Privacy Principles are designed to help units identify and develop proportionate and effective measures to ensure that individuals’ privacy is respected and help shape the way privacy is advanced, managed and protected at Penn State.
To help ensure these privacy processes are being followed, units can request a Privacy Impact Assessment, which analyzes how a unit collects, uses, shares, and maintains individually identifiable (or personal) information on behalf of Penn State.
The Privacy Impact Assessment helps units to understand the applicable legal, regulatory, and policy requirements for privacy; determine the risks and effects of collecting, using, sharing and maintaining identifiable information; and evaluate protections and alternative processes to mitigate potential privacy risks.
Privacy Impact Assessments are required when units initiate a new project that collects or generates identifiable information or may otherwise have privacy implications; or when a unit develops or procures any new technologies or systems that collect, maintain or disseminate identifiable information. This analysis also is built into system designs, ensuring data is being collected for legitimate business purposes and used appropriately.
Visit the webpage for more information and to complete a Privacy Impact Assessment form online.
To learn more about Penn State’s Privacy Program, visit privacy.psu.edu.