Privacy Framework and Principles

University executive leadership delegates responsibility for the oversight of privacy based on record/data type to the following compliance owners:

The University Privacy Sub-Committee is formed by the standing University Ethics and Compliance Committee with a specific focus on the privacy of personal information.

Authority

The Privacy Sub-Committee is formed by the standing University Ethics and Compliance Committee with a specific focus on the privacy of personal information.

Purpose

Western Washington University is committed to the protection and responsible use of personal information collected from and about its students, faculty, staff, alumni, donors, business partners, and others who engage with the University. Those responsible for handling personal information are expected to do so with the utmost care and in compliance with the University Privacy Program Principles. See the Affording Individual Privacy Rights Policy (POL-U5315.02).

The role of the sub-committee is to establish a written University Privacy Program designed to oversee the governance and oversight of privacy related activities necessary to ensure that:

1. The highest ethical standards are understood and consistently applied in the collection, storage, use, disclosure, and destruction of personal information,
2. Internal controls are effectively designed and implemented, and
3. A strong partnership is maintained between the privacy and information security program for effective data governance.

Sub-Committee Member Responsibilities

Assist Compliance Services with creating a written University Privacy program that includes, at a minimum:

• A framework and principles of a University Privacy Program,
• An action plan to meet the goals of the program and incorporates the elements of an effective compliance program
• A reporting structure for effective leadership oversight, and
• Clear communication methods for individuals to exercise their privacy rights.

Support individual privacy compliance owners by:

• Sharing ideas for implementing and monitoring internal controls for their individual privacy programs,
• Determining where tools and resources can be collectively designed and implemented to serve multiple privacy compliance areas, and
• Forming a collective voice for reporting to executive leadership on the progress, issues, and resources needed, to effectively manage privacy responsibilities and risks.

Sub-Committee Composition

Chair/Privacy Program Coordinator: University Compliance Officer

The Chair will be responsible for coordinating the activities of the sub-committee and reporting updates to the University Ethics and Compliance Committee.

Core Membership

The core members include Compliance Owners responsible for the oversight of records containing personal data. Delegated Compliance Owners by privacy regulatory category are listed under Compliance Category in the University’s Regulatory Compliance Accountability Matrix.

Other core members include subject matter experts essential to facilitating the goals of the sub-committee. Core members are recommended by the standing University Compliance Committee and approved by the Provost and Vice Presidents.

Core Members

• FERPA Officer (Student Data)
• AVP for Human Resources (Employee Data/Background Check Data)
• HIPAA Officer (Medical Data)
• Director of Financial Services (Financial Data)
• Vice Provost of Research (Proprietary Research/Intellectual Property Data/Export Controls)
• AVP for Advancement Services (Donors and Alumni Data)
• Assistant Dean of Libraries (Library Records)
• Chief Procurement Officer (Vendor data/Non-disclosure agreements/3rd Party Data Sharing)
• Director, Office of Institutional Research
• University Ethics Advisor
• Enterprise Application Services Director/Data Governance Committee Chair
• University Archivist/Records Manager

Ad Hoc Advisors and Key Stakeholders

Ad hoc advisors and key stakeholders identified by the sub-committee (or Compliance and Ethics Committee) and will be kept up to date on Sub-Committee activities and brought in to advise on specific issues, data, and activities as needed.

February 9, 2022- Approved by President’s Cabinet
February 25, 2022 – Minor Rev.

Western’s Privacy Management Framework

What is a privacy management framework?

The framework is a structured set of key functions and objectives from which tasks and controls are implemented to:

• Collectively address privacy related compliance requirements,
• Protect personal data and mitigate privacy risks, and
• Support and facilitate individual privacy rights.

What are the Benefits of a Privacy Framework?

• Streamlined approach to multiple laws
• Measurable program maturity
• Leadership assurance
• Increased efficiencies and reduced costs
• Improved risk mitigation
• Effective program evaluation
• Alignment with enterprise strategy
• Unification of privacy, security, and compliance efforts
• A sustainable privacy program

Western's Data Privacy Principles

Why are Data Privacy Principles needed?

• To ensure the Privacy Program aligns with and reflects Western's values.
• To support decision making when privacy regulations are:
  • In conflict,
  • Silent on a particular issue, or
  • Out-dated and not current with public expectations.

Due to its vast number of academic programs and business operations, Western Washington University is subject to various privacy laws. Below are the major data categories to select and view a summary of privacy law information related to each category. The laws listed under each category are not-all inclusive.

• Academic Data
• Financial Data
• Employment Data
• Research Data
• Medical Data
• Youth Data

• Washington State Office of Privacy and Data Protection
• International Association of Privacy Professionals
• NIST Privacy

2024

Please click on the monthly issue in either PDF format or in the accessible WORD format.