Re: Privacy Implications of using Student Photos

[Chris Kidd <chris.kidd () UTAH EDU>]

Anand,

In cases where photographs or other information is publicly available, I recommend an opt-in. The student should have 
the ability to control who can see the photograph and instructions on changing privacy settings should be clear. There 
should also be sufficient controls to ensure the photograph won't be made available on a search engine. I would also 
consider the impact open records laws might have on the photographs - would they have to be released pursuant to a 
records request?

Chris Kidd
Chief Information Security and Privacy Officer
The University of Utah
650 Komas Drive, Suite 102
Salt Lake City, UT 84108
Office: 801.587.9241
Cell: 801.747.9028
chris.kidd () utah edu 

http://www.secureit.utah.edu


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Anand S 
Malwade
Sent: Tuesday, December 15, 2009 3:08 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Privacy Implications of using Student Photos

I was curious to know what position other Universities have regarding the posting of Student photos on a web 
application that can be accessed by faculty and other students. 

Is an Opt out policy mandatory ?


if there any FERPA or other privacy guidelines around the same ? 



Thanks,
Anand



-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Howell, 
Paul
Sent: Sunday, December 13, 2009 6:21 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Models for Effectively Operating in Highly Decentralized Environments

Hi Chris,

The topic of centralized vs. decentralized IT environments is a common
topic for many of us.  Did you get many comments on your message?  If
you did receive comments, would you mind summarizing them for us?

The effective practices working group (part of the Educause security
task force) discussed your question this week, which triggered an
interesting conversation.  We're all facing budget pressures (some much
worse than others) and how we deal with becoming more efficient such
that our IT spend rates are reduced varies.  Some schools see further
decentralization by moving some functions and people to other areas as a
means to reduce costs, while others are moving to a more centralized
model to also reduce costs.  Both approaches can be beneficial,
particularly when they align to the desired direction of the academy.
How does responding to the budget pressures affect your security
program?  Are you considering consolidating security functions and teams
in a core team to enable efficiency, or are you distributing security
functions and staffs out into other area thereby reducing the size of
the central security team?

Cordially,

Paul Howell
Chief Information Technology Security Officer
The University of Michigan
(O) 734-763-0609
(C) 734-996-8008




-----Original Message-----
Subject:         Models for Effectively Operating in Highly
Decentralized Environments
From:    Chris Kidd <chris.kidd () UTAH EDU>
Reply-To:       The EDUCAUSE Security Constituent Group Listserv
<SECURITY () LISTSERV EDUCAUSE EDU>
Date:   Wed, 11 Nov 2009 09:54:23 -0700

We're working with some of our colleges to better coordinate security
efforts. How have you effectively integrated security into academic and
research environments, particularly Colleges that are extremely
decentralized and where the ownership of IT resources are fiercely
defended as "mine"?

Thanks,
Chris

Chris Kidd
650 Komas Drive, Suite 102
Salt Lake City, UT 84108
Office: 801.587.9241
Cell: 801.747.9028
chris.kidd () utah edu 

http://www.secureit.utah.edu