Data Privacy Toolbox

Four Step Approach to Data Practices Requests

Contact Sheri Sargent, sheri.sargent@mnsu.edu or 507-389-1112, for assistance.

Questions to ask in determining response

1. What is requested?

   • Is it data? (If the data does not exist, there is no need to create it.)
   • Is it government data?
   • If the answer to the above questions is "yes", then:

2. What is classification of data?

   • Type (e.g., personnel, educational, investigative, etc.)
   • Accessibility (e.g., public, private, confidential, etc.)
   • If the data is Public – immediate access if possible, or within "reasonable" time.
     See form [PDF] Request for Public Information (8 KiB).

3. What if the requested data is private, not public?

   • Identify who is requesting
   • If the requestor is the subject of the data, access is within 10 days
   • Others have no access without the written consent of the subject unless otherwise authorized:
     • School official with legitimate educational interests
     • Subpoena/Court order
     • Health or safety emergency
     • Other legal authority (e.g., INS)
     • Others as authorized in the Minnesota State University, Mankato Policy on Student Records

4. Are there procedures needed before release?

   • Redacting out private data on others
   • Completion of receipt of information form
   • Warning against re-disclosure
   • Maintain records of 3d party requests/disclosures of student data
   • Prior notice to student of subpoena/court order compliance

Finally Remember:

Access is free. If copies or other services are requested, check the schedule of charges.

Data classifications

Type	Description	Classification	Access
Government Data	All data collected, created, received, maintained, or disseminated regardless of its physical form, storage media or conditions of use	Public, unless the law says it is not public	Depends upon classification
Educational Data or Records	*Directly related to a student (includes former students and applicants) *Maintained by an educational institution or agency or a party acting for the institution or agency Not: Desk drawer notes, law enforcement records, employment records (not work study), treatment records, former student records (alumni information)	Private	To student, by consent [13 exceptions]
Directory Information	*Information not generally considered harmful or invasion of privacy if disclosed, e.g. address *Identified by institution with notice to student *Student does not object	Public, unless student objects	Access, unless student objects
Personnel Data	Data on individuals collected because the individual is or was an employee or an applicant for employment by, performs services on a voluntary basis for, or acts as an independent contractor with the state agency	Part public, part private	Depends on classification

FERPA and the MGDPA

[PDF] What Faculty and Staff Need to Know About Handling Education Records (54 KiB)