The University of Memphis

Data Access

POLICIES

University of Memphis' information is one of the University's most valuable assets.  Consistent with the University's obligation to preserve and protect such information by all appropriate means, it must be made available to all employees who have a valid business purpose for its use.  The University, as the owner of all data, has delegated its oversight to the Data Security Officer.

The value of data as an institutional resource is increased through widespread and appropriate use; thus, the University intends that the volume of freely accessible data be as great as possible while recognizing its responsibility to appropriately secure the data.  Therefore, procedures established to protect data cannot unduly interfere with the efficient conduct of University business.

Data that are necessary to the success of the University as a whole, generally shared with others, and are likely to be distributed across organizational units within the University. Datasets contained in a university administrative legacy system or database (ex: university business systems such as Human Resources, Finance Records, Student, Advancement, etc.; and college/unit specific databases, such as teacher certifications, etc.)

Data that are essential for the ongoing operation of the University of Memphis or for units within the University.  Mission-critical data may encompass administrative, research, and instructional data.

A self-documenting collection of information generally organized by tables (files), rows (records), and columns (fields).  Databases can be Network (organized by ownership of records, allowing records to have multiple owners and thus providing multiple access paths to the data); or RDBMS (relational database management system in which the database is organized and accessed according to the relationships between data items; ex:  Access, SQL Server, Oracle).

• All data supporting the business and operational needs of the University of Memphis.
• Information and data in all forms, including but not limited to, information-processing activities, computerized data (whether stored on mainframes, SANS, servers or personal workstations), and manually maintained data files.
• All application, network, and operating system software used for computerized management of this data.
• Computerized data-processing activities related to research and instruction where the Data Security Officer determines that such activities should be covered by this policy.
• All data owned by or within the control of the University.

Violations of this policy may lead to disciplinary action by the University up to and including dismissal from the University.  Under certain circumstances, such violations may give rise to civil and/or criminal liability.

The University determines levels of access of data according to principles drawn from various sources such as federal and state law, TBR and University regulations, and ethical considerations.  Staff accessing University data must observe requirements for confidentiality and privacy, must comply with protection and control procedures, and must accurately present the data in use.

The University maintains data in a variety of databases.  After completing appropriate screening, data stewards may access data on a "need to know" basis.  Access to data is granted based on job responsibility and the supervisor's approval.  Frequently, the data thus accessed can be downloaded or exported to other applications such as desktop databases (i.e. Access), spreadsheets, text, or hypertext.  The data steward is thereby obliged to treat the data according to the same security and privacy rules in force within the system of origination regardless of where it is stored.

Copies of official data are NOT official data. Data derived from copies or downloads shall not be used as substitutes for official records kept by the authorized data steward of the University. However, such information may be used to generate official reports on behalf of the University with the knowledge and permission of the official data steward. Such files and resulting reports are covered by the same constraints of confidentiality and privacy as the official records.  

The legacy system is comprised of the following data systems:  Human Resources, Financial Records, Advancement, and Student.

You can either contact the University office that has primary responsibility for maintaining the data or Information Technology Division. 

Eventually, the Data Warehouse will assure the integration of data so that University business questions are easier to answer. (Ex:  Questions about classroom success of specific students with specific financial aid.)  Data Warehouse, Office of Institutional Research, ePrint, and Matrix can be accessed through the University portal.

"Local" (departmental) databases contain data critical to the academic or administrative mission of the college or administrative unit and must be protected by the same rules and security as that of the administrative legacy systems.

Access to institutional data is a right reserved to data stewards who have need to utilize the data for benefit of the university.

To request access, contact the University office that has primary responsibility for maintaining the data.  Users may be required to successfully complete training before access will be granted.

Systems can differ in several important ways.  Three of the most common are: ease of accessibility, understandability of stored data, and tools provided for access.  In many of our administrative systems and other applications, the data are stored in relational databases with more easily understandable table formats and common file names, and utilize a number of tools that can be used to retrieve or analyze data.

http://www.enrollment.memphis.edu/registrar/records/release.htm

http://itd/aboutitd.htm

UM1337 - Revised: March 18, 2008
UM1337 - Revised: January 14, 2004
Originally Issued: June 19, 2003