143 SPEC Kit 360: Learning Analytics UNIVERSITY OF WATERLOO Guidelines for Managing Student Information for Faculties, Academic Departments and Schools https://uwaterloo.ca/secretariat/guidelines/guidelines-managing-student-information-faculties- academic Locally maintained databases, SharePoint sites, and other electronic collections of student information Copies and other types of non-official student information are subject to the same security and destruction requirements as official records. Non-official information should be retained only as long as necessary for current work. Anonymous data may be preserved. If a unit wishes to keep a database (for analysis or trend purposes, for example) which is otherwise scheduled for destruction, it may do so if all identifying information of individuals is removed from it. Assistance may be sought from the university’s Privacy Officer. Electronic versus paper documents: A common misperception is that retention and disposal rules apply only to paper documents. In fact, the same rules apply regardless of the format in which the information is maintained. Therefore, when it is time to dispose of the paper copy of a document, it also time to dispose of the electronic version and vice versa. Legal action: Student information that is related to actual or pending litigation or a government investigation must not be destroyed even if the retention period has expired. This restriction begins from the moment when a legal action or a government investigation is reasonably foreseeable, and remains in effect until removed by the Secretary of the University. Any member of faculty or staff who suspects a legal action or investigation may be pending should ensure their department head is aware of the matter. The department head should inform the Secretary of the University. The Secretary will notify you when records should be retained. For questions or concerns regarding retention and disposal of student information, contact the University Records Manager. E-mail Be aware that under FIPPA a student may request to see any e-mail about him/her sent by a faculty or staff member. Most e-mails, such as correspondence between an instructor and a student relating to a course or relating to routine inquiries, should be retained for one year and then deleted. E-mails documenting a significant decision about a student’s academic career should be retained as part of the student file. E-mail is not secure unless encrypted. Avoid use of e-mail to transmit sensitive personal or confidential information. If you must use e-mail to communicate, consider how to minimize the consequences of unintended disclosure (e.g., by disclosing only some information or by deleting personal identifiers). If you frequently use email to send sensitive information, consider whether there are other ways to deliver the information, such as use of a SharePoint site, or a secured, shared network drive. It may be better to communicate some types of information by telephone or in person. To minimize the potential for a breach, instructors are encouraged to correspond with students only through the students’ Waterloo email addresses. It is suggested that instructors indicate on course outlines that they will only respond to emails sent from students’ Waterloo email addresses. See the university’s Guidelines on Use of E-mail for more information. Best Practices for Managing Student Information Centralize student files where possible this ensures that all substantive records relating to a student’s academic history are located in one easily accessible location, and will mean that personal information about a student can more easily be protected as well as retrieved in the case of an information access request, dispute, or some other emergency. When working away from campus, access student information through central systems such as Quest or OnBase or using remote desktop, rather than by removing files. Include information on privacy, security, retention, and disposal of student information as part of the orientation for new faculty and other course instructors, teaching assistants, and staff members. Make arrangements for departing course instructors such as sessional lecturers who are leaving the university and faculty members who are retiring to leave their course records (class grades, examinations and assignments, etc.) with the academic department or school. File students’ academic information separately from employment information (e.g., records of teaching or research assistantships, co-op or work study positions). Employment information has different retention requirements than student academic information.