Sharing Data with University Faculty and Researchers

This procedure defines how and when members of the University community can share public or private unit record data and or aggregate-level administrative data with University of Minnesota faculty and researchers. This procedure applies to all University providers of data, including individuals and units. Units include, but are not limited to central units (e.g., Office of Institutional Research, central-work streams such as Human Resources, etc.), colleges, departments, centers, and programs.

Individuals or units providing data in any form, including the secondary release of data, are responsible for the application of this procedure and its related policy (see Administrative Policy: Public Access to University Information).

The standard for sharing personally identifiable private student data is defined in the Regents Policy on Student Education Records. The policy defines “legitimate educational interest” as “an interest in reviewing student education records for the purpose of performing an appropriate University research, educational, or administrative function (see below examples). The University uses the same definition of “legitimate educational interest” for sharing other private data on individuals within the University.

Example 1 When a University Researcher is doing sponsored research (i.e., under a grant or a contract with the University) they are performing a “University research function.” In those cases the “legitimate educational interest” is met, data can be shared without the need for further approval.

Example 2: When a University researcher is not doing sponsored research, the researcher should get approval from a department head or dean’s office, to validate that the person is performing a “University research, educational, or administrative function.”

In all cases where the research is subject to the Institutional Review Board (IRB), the researcher must follow IRB requirements. However, the IRB doesn’t determine the “legitimate educational interest”, so the above rules should apply.

Out of Scope for this Procedure

Private data (e.g., health information (HIPAA; or ePHI), social security numbers, PCI DSS) that is classified as Private-Highly Restricted as defined in Administrative Policy: Data Security Classification will not be shared in this manner and are out of scope for this procedure.

Those receiving requests (providers) for data from internal University audiences should be directed to Administrative Procedure: for Sharing Data with University Educational and Administrative Audiences.

Those receiving requests (providers) for data from external University audiences should be directed to Administrative Procedure: Sharing Data with Audiences External to the University.

Procedure for Sharing Data with University Faculty and Researchers

1. Providers determine if the request is for public, private, or a combination of public and private data.
2. Data classified as public may be shared with University faculty and researchers in unit record as well as aggregate form no matter the cell size (see Table 1.0 below).
3. Those requesting private data need to demonstrate a “legitimate educational interest” that is consistent with the above definitions. Requests will be reviewed and approved on a case by case basis by the owner of the requested content or by the provider.
4. At the discretion of the data owner or data provider, requests may require a written description on how the data will be used and stored along with a non-disclosure agreement (DOCX).
5. When possible providers should leverage existing public reports prior to further action.
6. Depending on the requirements of a given request, unit record data classified as private should be de-identified prior to sharing. If private data can’t be de-identified a non-disclosure agreement may be necessary.
7. Data suppression or masking is required when private data exists and one or more of the summarized cell sizes are less than ten (with the exception of item #6 above). For a list of public and private data elements see Administrative Policy: Public Access to University Information.
8. When a given case requires data suppression, units should apply one of the following techniques when sharing private aggregate data.
   1. Ranges (see below) with no totals
      1. 1 – 10
      2. 11 – 15
      3. 16 – 20
      4. Over 20
   2. Percentages with no totals (mask rows/columns with 100%)
   3. Suppression of small cell sizes with no totals
9. When sharing the data, providers should limit the data and reporting to the scope, depth, and breadth that is consistent with the requester’s needs.
10. Data will be shared in a number of ways, including the following methods:
    1. Through the web (e.g., oir.umn.edu)
    2. Through ad hoc reporting requests
    3. Through secondary release via subsidiary reporting systems

General Notes:

1. Suppression involves applying the rule of ten to summarized data through the use of percentages, ranges or masking
2. Unit Record Data refers to individual student and employee level data
3. Aggregate refers to the summarization of unit record (detail) data
4. OGC refers to the Office of the General Counsel

All questions about this procedure or how to apply it should be routed to Data Governance by sending an email to [email protected].