PDP Task Force Charge Letter [pdf]
(Original on Provost Letterhead)
November 3, 2020
Personal Data Processing Task Force
Erin Guthrie, Assistant Vice Provost, University Analytics & Institutional Research, Office of Planning and Budgeting, co-chair
Ann Nagel, Associate Vice Provost for Privacy, Privacy Office, Academic and Student Affairs, co-chair
Ann Anderson, Associate Vice President, Enterprise Services, Finance
Glenna Chang, Associate Vice President, Student Life
Richard Fenger, Chief Data Strategist for Research, Information Service, Office of Research
Helen Garrett, University Registrar, Enrollment Management, Academic and Student Affairs
Rachel Gatlin, Executive Director, Benefits, HR Benefits, Analytics & Information Systems, Human Resources
Andrew Gorohoff, Interim Director of IT, Graduate School
Laurie Halvorson, Director, Chief Business Office, Administration and Finance, School of Medicine
Erik Hofer, Associate Vice President for Academic Services and Deputy Chief Information Officer, UW-IT
Christy Long, Assistant Vice Chancellor for IT and Chief Information Officer, UW Bothell
Jason Malone, Assistant Director of Regulatory Affairs, Human Subjects Division, Office of Research
Lenny Sanchez, Director, UW Medicine Compliance
Michael Visaya, Assistant Vice President for Information Management, Advancement Services
Ex-officio:
Jacob Morris, Enterprise Business Architect, UW-IT
Nancy Garland, Assistant Attorney General, UW Division of the Attorney General’s Office
Kerry Kuenzi, Privacy Analyst, Privacy Office, Academic and Student Affairs
Dear Colleagues,
Thank you for your willingness to serve on the Personal Data Processing Task Force. Information about UW’s collection and use of personal data is currently spread across various inventory tools, databases, or project documentation that is siloed at the unit level. As such, the UW does not have information readily available in a single location to develop an institution-wide strategy for protecting privacy of personal data.
The UW Privacy Steering Committee is currently updating UW privacy policies to help the UW address this gap and the evolving legal and ethical aspects of privacy. Simultaneously, the UW needs to develop processes, templates, and tools to help operationalize the policy.
As such, the UW will be implementing a new software as a service (SAAS) solution for the UW and its units to for identify the purpose and related business processes for gathering or creating personal data, the types of personal data gathered or created at UW, where the data resides, and the associated privacy risks for the UW and privacy impact on individuals.
The new solution along with supporting processes, templates, and tools is a fundamental privacy responsibility for UW and the foundation for UW to be transparent with its constituents about the use of their personal data. Centralizing this information will reduce the duplication of effort associated with developing and maintaining such records in disparate areas across the UW.
As we move forward with this effort of inventorying, mapping, and assessing UW’s personal data processing activities, it is important that we have a cohesive understanding of UW’s business processes, efficient and effective workflows, and clear end user expectations. The scope of the Personal Data Processing Task Force includes all the locations and all personal data other than data that is solely and uniquely HIPAA protected health information. The Privacy Office has engaged consultants to help with certain aspects of this effort. The Task Force will report to the Privacy Steering Committee and the members are charged with working with the consultants, where appropriate, to address the following:
- Refine existing or document new resources that describe at a high-level the data lifecycles for specific data domains that involve personal data;
- Refine existing or document new resources that describe at a high-level the business processes that relate to the data lifecycles;
- Identify, with in the SAAS solution, the common types of personal data collected, received, or created by UW in connection with the high-level business processes;
- Identify and confirm roles and responsibilities, summarized on the RACI for inventorying, mapping, and assessing personal data processing activities;
- Review, and help ensure that templates and workflow processes for inventorying, mapping, and assessing privacy impacts of personal data processing are efficient, effective, and user-friendly;
- Develop cohesive templates and workflow processes for centralizing, documenting and assessing data requests that are sent to various departments for sharing personal data repositories for internal and external use (excluding public records requests);
- Review and where needed enhance materials provided by the consultants for helping UW accomplish the above activities.
As you work through this charge, your recommendations should be based on the existing, in-progress, and anticipated near-future UW policies. You will need to align your deliverables, milestones, and timelines with the consultants who are assisting with implementing the vendor provided SAAS solution. You will present deliverables and recommendations to the Privacy Steering Committee.
This effort will call for significant people, process, and technology change management effort across the UW, all in the best interest of our constituents. Long term, it will help UW Privacy Office and the Privacy Steering Committee work cross functionally and in collaboration with data stewards to develop privacy policies and appropriate use guidance for specifics types of personal data. Such guidance will support our colleagues in their day to day job duties and also assist the data governance committees with their charge.
Nancy Garland, Assistant Attorney General, will advise the task force on legal and regulatory matters. Thank you again for your willingness to help with this important work.
Sincerely,
Mark A. Richards
Provost and Executive Vice President for Academic Affairs
Professor, Earth and Space Sciences
cc:
Cheryl A. Cameron, Vice Provost for Academic Personnel
Kim Dinh, Senior Director, Executive Office of the President and Provost
Sarah Norris Hall, Vice Provost for Planning and Budgeting
Philip Reid, Vice Provost for Academic and Student Affairs
Margaret Shepherd, Chief of Staff, Executive Office of the President and Provost