Standard Number: IT.2.5.2S
Category: Information Privacy
Owner: Information Technology Services
Effective: September 2, 2018
Revision History: None
Review Date: September 1, 2021
PURPOSE, SCOPE AND RESPONSIBILITIES
- The West Virginia University (“University”) Identification Card Policy establishes the University will issue a University Identification Card for Eligible Individuals and that such cards will not be issued without a photograph or digital image of the individual. The University considers identification card photographs as Limited-Use Directory Information under FERPA, which it can share within the University for technology systems hosted by, on behalf, and for the benefit of the University.
- The purpose of this Standard is to establish the rules for access to and use of a University Identification Card Photograph.
- This Standard applies to all University organizational units and their faculty, staff, and students.
- The Executive Director for Enterprise Support is responsible for the implementation and enforcement of this Standard. The University’s Chief Information Security Officer will make the final determination whether photograph files will be shared when there is a dispute.
- ITS Campus Application Administration team will review all requests and determine if the requestor meets the requirements to access University Identification Card Photographs. Information Security Services will be consulted when there are questions or concerns about the security related to sharing of the data.
- WVU’s Office of Legal Affairs will determine if the classification of identification photographs should change under FERPA.
UNIVERSITY IDENTIFICATION CARD PHOTOGRAPH USAGE
- ITS will only release photographs from the identification card system (“CS Gold”) upon confirmation that the requesting system is hosted by, on behalf, or for the benefit of the University.
- Use of photographs must be for an approved, legitimate University use that requires visual identification of individuals such as class rosters, academic advising rosters, housing, or conduct violations.
- Requests that are for a University business purpose but for which photographs are not required for system functionality may be approved or denied on a case-by-case basis.
- Storing local copies of photographs is a security and privacy risk. Exceptions
allowing this practice will be rare. Approval of local storage must meet
the following requirements:
- Photographs may only be used for the purpose for which approval was granted;
- Photographs may not be retained for more than three (3) months. All local copies must be deleted and replaced quarterly;
- Access to local data must be granted to the fewest number of people as possible. Access lists must be reviewed annually and updated accordingly; and,
- Photographs must be maintained on up-to-date software and operating systems.
- Granting a third-party access to local storage of University Identification Card Photographs is strictly prohibited. Any requests for access to photograph files must be forwarded to ITS Campus Application Administration for review and approval.
- Two-factor authentication is required for all systems using photograph images from CS Gold.
- Photographs must not be shared outside of the University or on University public websites without approval from the student(s). For example, photographs may not be used on class rosters that are distributed to non-University officials.
- Copying photos from any University System and using them for another, unapproved purpose is prohibited.
- Any other use of University Identification Card Photographs is prohibited.
- Systems or individuals found in violation of this Standard will have their access to University Identification Card Photographs removed and be subject to appropriate disciplinary action.
“Eligible Individuals” means the groups of individuals who are eligible to be issued
a University Identification Card. The following groups are Eligible Individuals:
- Students that are enrolled and attending the University.
- Employees with a full- or part-time appointments, retired employees, and individuals with Emeritus status.
- Other Individuals who are authorized to be on-site, unescorted, and authorized by a sponsoring department to use University Services and Facilities.
- “University Identification Card Photograph” means the image found on a University Identification Card. Photographs for University Identification Cards are either taken at an approved University card issuing site or by the card holder uploading a personal image.
- “University System” means a software system designed to facilitate the academic, business, research, and outreach activities at the University such as STAR, Banner, and eCampus.
- “Eligible Individuals” means the groups of individuals who are eligible to be issued a University Identification Card. The following groups are Eligible Individuals: