Privacy Policy, General
To set forth requirements regarding information entrusted to the University by the public and members of the KU community.
All units in their handling of data, information and records in any form (paper, digital text, images, audio, video, microfilm, etc.) created, collected, accessed, used, handled, stored, managed or disposed of during the course of conducting University business (administrative, financial, instruction, research or service).
KU Commitment to Privacy
The University of Kansas is committed to safeguarding all Private Information entrusted to the University by the public and members of the KU community. This notice describes the University’s general privacy policy as it relates to the collection, protection and disclosure of such information. (Note: see the “Definitions” section below for the definition of “Private Information.”)
Collection and Protection of Information
Information may be collected in a variety of ways, paper or electronic, including but not limited to, Web sites, surveys, email, information requests, databases, etc., as required to support University activities.
Information collected, regardless of the method of collection or format, may be used only to carry out the authorized business of the University. The University shall make reasonable efforts to limit the Private Information it collects to only that information strictly relevant to accomplish a clearly defined institutional purpose.
Every unit is responsible for maintaining the necessary confidentiality, integrity and availability of the information it handles. Every unit is responsible for granting to assigned individuals within the unit the reasonable, minimum access to Private Information needed to accomplish the necessary institutional purposes. All University employees are required to abide by state and federal laws and University policies, procedures and guidelines regarding the handling and protection of Private Information.
Employees who become aware of a breach of the privacy or security of Private Information must report such breach immediately to the Information Services Customer Service Center at 864-8080. The Information Services Customer Service Center will notify the Office of the General Counsel and/or the KU IT Security Officer as required by the particular incident.
Additional University policies, procedures and guidelines apply to specific types of information. Further, individuals for whom the University collects, maintains, or processes their personal data are directed to review the supplementary Privacy Notice, provided here in accordance with European Union General Data Protection Regulation (GDPR) available at this link.
Cookies
“Cookies” are small text files which are either used for the duration of a session ("session cookies"), or saved on a user’s computer or device in order to identify that user, or information about that user, the next time the user logs on to a website (“persistent cookies”). Users can manage cookies through their browser settings. University websites use cookies and similar technologies to improve functionality and performance of the sites and to understand the user experience, among other uses. By continuing to use University websites, users agree to the storing of cookies and related technologies on their computer or device until cookie expiration or deletion.
Disclosure of Information
Private Information may be disclosed only to the extent that is permitted or required by law. Disclosure must comply with applicable requirements regarding consent or authorization for disclosure.
Legally Mandated Disclosure of Information
The University may be required to release information, including Private Information, where required by state or federal law or upon receipt of a subpoena, search warrant or other court order.
KU Employee Privacy When Using University Resources
The University supports a climate of trust and respect. The University does not ordinarily read, monitor or screen employees’ routine use of information resources, except as necessary to maintain quality of service, to investigate a breach of security or misuse of University information resources or where required by law.
For additional information about the appropriate use of University resources, refer to the Acceptable Use Policy.
Violations of this policy may result in disciplinary action, up to and including dismissal of employees. Employment actions will be conducted under the advice and guidance of Human Resources and the Office of the General Counsel.
Information Services Customer Service Center
1001 Sunnyside Ave.
Lawrence, KS 66045
785-864-8080
itcsc@ku.edu
The Office of the General Counsel
245 Strong Hall
1450 Jayhawk Blvd.
Lawrence, KS 66045
785-864-3276
gencoun@ku.edu
KU IT Security Officer
1001 Sunnyside Ave.
Lawrence, KS 66045
785-864-9003
itsec@ku.edu
Private Information: includes all information protected by state and/or federal law or that the University is contractually obligated to protect. Private Information also includes information designated by the University as private (confidential or sensitive) through the creation of standards, procedures and guidelines. Access to these data must be tightly monitored.
Examples of Private Information include, but are not limited to the following:
- Nondirectory student records as defined by FERPA and the University Student Records Policy
- Financial aid and scholarship records
- Individually identifiable personnel records
- Personal information utilized to verify identity, including but not limited to Social Security numbers (SSN) and University ID numbers (KU ID)
- Passwords and PINS
- Digital signatures
- Individually identifiable health information protected by state or federal law (including but not limited to “protected health information” as defined by the Health Insurance Portability and Accountability Act (HIPAA)
- Individually identifiable information created and collected by research projects
- Credit card numbers and financial transactions covered by the Payment Card Industry (PCI) Standard.
- Information resources with access to confidential or sensitive data
- Information covered by nondisclosure agreements
- Any information relating to an identified or identifiable person, or personal data, as defined in the GDPR
05/29/2018: Updated link to European Union Data Protection Regulation.
05/25/2018: Updated to comply with European Union General Data Protection Regulation (GDPR).
05/30/2017: Fixed broken link.
01/09/2015: Policy formatting cleanup (e.g., bolding, spacing).
12/17/2014: Updated contact information, made technical edits related to formatting and hyperlinking of related documents.
04/06/2009: Reviewed for accuracy; no changes made.
10/30/2007: Approved by the Provost and Executive Vice Chancellor.
