135 SPEC Kit 360: Learning Analytics UNIVERSITY OF MINNESOTA Sharing Data with University Educational and Administrative Audiences https://policy.umn.edu/operations/internalaccess-proc04 Those requesting private data need to demonstrate a “legitimate educational interest”. At the discretion of the data owner or data provider and on a case by case basis requests may require review and approval by the owner of the requested content. 1. At the discretion of the data owner or provider, requests may require follow up with the respective department head, dean’s office or administrative office of those requesting data to determine appropriate use and to determine if requester’s work assignment reasonably requires access. 2. Providers determine if the request is for public, private, or a combination of public and private data. For a list of public and private data elements see the appendix: Examples of Public, Private and Confidential Information in Administrative Policy: Public Access to University Information. 3. If all data being requested are classified as public, providers may share the data with internal audiences in unit record form or in aggregate form no matter the cell size (see Table 1.0 below). 4. Aggregate data that is classified as private may be shared with internal audiences assuming the requester has a business need to know to perform their job duties. (see Table 1.0 below). 5. Those who do not meet the need to know requirement should be directed to the public reports available (see Administrative Procedure: Sharing Data with Audiences External to the University). 6. The completion of an Access Request Form (ARF) will be required for those requesting access to private unit record data used for query/direct access to the Data Warehouse and other PeopleSoft sources and approved by the respective data owner. 7. When sharing the data, providers should limit the data and reporting to the scope, depth and breadth that is consistent with the requester’s needs. 8. Data suppression or masking is not needed for reporting containing only public data 9. Data will be shared in a number of ways including following methods: Through the web (e.g., www.oir.umn.edu) a. Through ad hoc reporting requests b. Through secondary release via subsidiary reporting systems c. 10. Table 1.0 – Summarizing requirements for sharing data with audiences internal and external to the University including University faculty and researchers A B C D Public Data Private Data Audiences to Share Data with Item Aggregate Unit Record Aggregate Unit Record Internal Audiences (with need to know) 1 Yes Yes Yes ARF Audiences External to the University 2 Yes Yes Suppression No University of MN Faculty and Researchers 3 Yes Yes Case-by-case Case-by-case Table Descriptions: 1D = Access Request Form (ARF) used by those requesting query access to data 1. 2C = Suppression should be applied with no more than one private data element per aggregate 2. 2D = Private unit record data will not be shared however appeals can be sent to the OGC 3. 3C = Requests will be reviewed on a case-by-case basis and may require a non-disclosure agreement 4. 3D = Requests will be reviewed on a case-by-case basis and may require a non-disclosure agreement 5. General Notes: Suppression involves applying the rule of five to summarized data through the use of percentages, ranges or masking 1. Unit Record Data refers to individual student and employee level data 2. Aggregate refers to the summarization of unit record (detail) data 3. OGC refers to the Office of the General Counsel 4. All questions about this procedure or how to apply it should be routed to Data Governance by sending an email to firstname.lastname@example.org.