Privacy Principles

Penn State limits what personal information is collected and only retains personal information for current business purposes or as required by law, University policy, or as needed for purposes of security, health and safety, academic integrity, disciplinary actions, administrative functions, or student support, or with the consent of the individual. Personal information will be securely deleted when no longer necessary (as specified in University Policy, AD53, Privacy Policy and AD35, University Archives and Records Management);

Penn State is committed to ensuring that personal information is correct. Personal information should be relevant to the current business purposes for which it is used, accurate, complete, and up-to- date;

Pursuant to these Principles, the University will establish procedures to govern how individuals’ information can be used. Penn State will review and monitor projects and other initiatives that request the use or collection of data sets that include any “unique identifiers” which can be used to identify, contact, or locate a single person, or which can be used with other sources to identify a single person;

Penn State ensures that information is properly secured in accordance with the risk it represents to individuals: a University-wide security program will be designed and maintained with due-diligence as defined in University Policy AD95, Information Assurance and IT Security and its corresponding Security Standards; and specified risk-based security safeguards will be implemented to protect individuals’ information from loss, unauthorized access, destruction, use, modification, or disclosure; and

Penn State holds its faculty, staff, and students accountable: Penn State units, departments, colleges, and campuses that access, collect, manage, and store individuals’ information must be accountable for providing and incorporating the above Privacy Principles in their daily practices and business decisions.