Privacy of Personal Information Policy

Policy Summary

The George Washington University ("GW" or "university") is committed to maintaining the privacy of personal information processed during the course of its operations. Its collection and use of personal information is based on compliance with applicable privacy laws and regulations and follows best practices concerning data privacy and protection. This policy also establishes the individual responsibilities of GW Community Members to safeguard and respect privacy when collecting, using, and processing personal information in the operation of the university, and on behalf of the university. 

Related Regulations

The Family Educational Rights and Privacy Act (FERPA), Gramm-Leach Bliley Act (GLBA), the General Data Protection Regulation (GDPR), and other applicable privacy laws and regulations.

Who is Governed by this Policy

• This policy applies to all university faculty and staff and other individuals and entities including, but not limited to contractors, temporary employees, sponsored researchers, affiliates, and visitors (“GW Community Members”).

Policy

Personal Information plays a critical role in the university's educational, research, administrative, and public service activities. The university recognizes the importance of maintaining the privacy of the personal information it collects, has access to, uses, and processes. 

In its collection, use, and processing of personal information, the university commits to the following privacy principles to promote a culture that values privacy, to create a foundation from which the university can operationalize privacy at GW, and to comply with obligations that may be imposed by law, regulation, or agreement:

It is an expectation that GW Community Members involved in the collection, use, and processing of personal information for or on behalf of the university to assist in meeting its commitment to these privacy principles. 

In addition to the privacy principles outlined above, GW Community Members who collect, have access to, use, and otherwise process personal information, are expected to: 

• Comply with the university’s Privacy Policies addressing the privacy and protection of personal information.
• Understand the specific responsibilities and obligations imposed by applicable data privacy laws, regulations, or agreements, with respect to their collection, use, and/or processing of personal information within their activities, and be able to demonstrate compliance as needed.
• Complete privacy trainings assigned or recommended by the GW Privacy Office, participate in promoted privacy trainings, and seek guidance and advice from the GW Privacy Office, as needed.
• Implement appropriate managerial, operational, physical, and role-based controls to maintain the security and confidentiality of personal information, and comply with the university’s Data Classification and Protection Guide, Cybersecurity Risk Policy, and Acceptable Use of IT Resources Policy.
• Understand and follow the university’s requirements and processes for sharing data internally to the university, and externally, with third parties.

• Not sell or otherwise publicize personal information processed on behalf of the university.  

• Cooperate with the GW Privacy Office to timely and adequately address individuals’ requests to exercise their privacy rights in compliance with privacy law and regulatory requirements. 

• Promptly report any suspected or actual data incident to the GW Privacy Office and to GW Information Security via the Data Incident Report Form and/or via email to [email protected]. 

•  Supervisors: Promote and communicate the principles of this policy with their units, and administer appropriate steps and training to help ensure compliance.

Social Security Numbers

GW Community Members must be attentive to the collection and use of Social Security Numbers (SSNs). SSNs may only be collected, retained, and used, in whole or in part, as permitted or required by law or deemed essential for university purposes. Examples of permitted use include tax reporting, financial aid, human resource purposes, and law enforcement. Refer to the Appropriate Use of Social Security Numbers at GW for a list of appropriate uses of SSNs by the university. Any collection or use of SSNs for a purpose not outlined in the guidance must be submitted for review to the GW Privacy Office.  

Definitions

• Data Incident: Loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or similar term referring to situations where persons other than authorized individuals, and for other than an authorized purpose gain access to university data where the privacy, confidentiality, integrity, and/or availability of personal information of individuals may be affected. 
• Data Processing: All operations performed on personal information, including collection, access, recording, organization, storage adaption or alteration, retrieval, use, disclosure by transmission, and erasure, or destruction of personal data.
• Personal Information (Personally Identifiable Information or Personal Data): As defined under applicable privacy laws is any information that relates to an identified or identifiable individual. This includes any information that can be used to identify a person and it can range from basic and standard information, such as an individual’s name, address, and date of birth, to more sensitive types of information. Sensitive Personal Information includes racial, or ethnic origin, political opinions, religious or philosophical beliefs, union membership, financial information, genetic data, biometric data (where used for identification purposes), data concerning health, data concerning a person’s sex life, data concerning a person’s sexual orientation. 

Different pieces of information, which, when collected together, can lead to the identification of a particular person, also constitute personal information.  

Forms

• Data Subject Access Request Form
• Data Incident Reporting Form
• Submission of Privacy Questions or Concerns

Related Information

• Acceptable Use of IT Resources Policy 
• Cybersecurity Risk Policy 
• Appropriate Use of Social Security Numbers at GW 
• Health Information Privacy Policy 
• Privacy of Student Records (FERPA) Policy  
• Records Management Policy 

Contacts