Advancement

							                           LEHIGH UNIVERSITY
                      Advancement Office Data Policy Statement
                                  April 22, 2010
Purpose
To establish policy and implement procedures, supplemental to the University’s policy
administered by Library & Technology Services, that recognize the critical importance of
information as a significant resource of Lehigh University, and further to provide a
consistent set of guidelines regarding the disclosure of information accessible by the
Advancement Office or Alumni Association (LUAA). This policy additionally seeks to
achieve an equitable balance between the rights of constituents to privacy and the
interests of the University. In this context, constituents are defined as any individual or
organization in which the University has an interest, financial or otherwise, in collecting
data. This includes but is not limited to alumni, parents, friends, corporations,
foundations, etc.

Information recorded includes but is not limited to demographical data and donor history
sufficient to meet the general needs of Lehigh University. The information within the
database is intended solely for purposes related to the University’s programs. While
some of the information collected is within the public domain, much of it is exempt from
public disclosure. This policy has been reviewed by legal counsel and approved by the
Lehigh University Board of Trustees.

All written reports containing constituent data must be handled with utmost attention to
the sensitive nature of their contents. This includes who uses the reports, how they are
shared, the method of storing them and how they are destroyed at such time as they are
no longer useful. Information contained in reports or otherwise obtained regarding
Lehigh University constituents shall not be released to anyone outside the University for
any purpose unless so authorized under the provisions of this policy.

While the University is acknowledged as the owner of the data, it is the responsibility of
Advancement/LUAA to ensure the confidentiality and integrity of all data with which its
employees come into contact during the normal course of employment. This will be
handled via a combination of protective measures and appropriate training. The Data
Steward/Data Manager of Advancement will have ultimate responsibility to enforce this
policy and its provisions. Exceptions to this policy may be granted only by the Vice
President of Advancement, Assistant Vice President, Alumni Relations, Provost or
President of Lehigh University.

I.      General Computer Account for Employees of Advancement and LUAA
All new Advancement/LUAA employees are given a computer account, which allows
access to applications and functions associated with electronic mail, workstations and
modems. This process starts when Human Resources enters complete information for a
new employee into Banner. The information then passes to the accounts database where
the email/LAN account is assigned by LTS/Client Services.
Employees may then open their computer account, part of which is a requirement to read
and accept the University policy on computer systems and facilities.


1
4-22-10
RLF
                           LEHIGH UNIVERSITY
                      Advancement Office Data Policy Statement
                                        April 22, 2010
New Advancement/LUAA employees are also given the CASE “Donor Bill of Rights”
and this policy. The original signed policy will be retained by the Director of
Advancement Services or his designee. The Donor Bill of Rights will be reviewed and
signed annually by all employees of Advancement and LUAA. A current signed policy
must be on file in order for any staff of Advancement/LUAA to obtain constituent
information.

Banner Account
Banner provides additional levels of security for the information contained with the
database. First, a separate password is required to gain access to the database. All new
employees are required to complete a training session to learn basic navigational skills
for the Banner database and are required to sign a Family Educational Rights and Privacy
Act (FERPA) agreement related to the confidentiality of student information. Upon
completion of training, a confidentiality agreement is issued by Client Services. Once the
confidentiality statement is signed and dated, an Oracle password is assigned to the new
employee by Client Services. Receipt and use of a password constitutes acceptance by
the employee to adhere to a policy of strict confidentiality regarding all information made
known to the employee in the course of their job functions.

Security Classes
Security classes are determined based on the functional needs of each employee’s duties.
The new employee’s supervisor will request access for each new employee and the
Director of Advancement Services will determine the appropriate security assignments.
The process actually encompasses two separate levels of security. Oracle (the database
upon which the Banner program is built) security is assigned on the basis of roles. For
example, the ‘role’ of report writer allows read-only rights to the underlying tables.
Within Banner itself, security is further defined via classes, which encompasses groups of
forms. The classes are structured to accommodate the need for either query status (does
not permit changes) or modification status (permits changes). Access for reporting
purposes is defined in a separate Oracle role.

Modification of Banner Access
In the event an employee’s job requirements change such that different Banner rights are
needed, the above procedure is repeated. Additional training may be required of the
employee at this time. It is the responsibility of the Director of Advancement Services to
determine appropriate security class changes and contact Client Services when an
employee leaves or joins our department, or requires different security classes.

Revocation of Banner Access
In the event an employee leaves Lehigh University, payroll will notify Client Services to
terminate that employee’s Banner account. If an employee is terminated, the supervisor
has this responsibility, and the notification to Client Services should be immediate in
order to safeguard the Banner database from any intentional damage by a disgruntled
employee.

2
4-22-10
RLF
                           LEHIGH UNIVERSITY
                     Advancement Office Data Policy Statement
                                 April 22, 2010


Approval of Specific Requests for Constituent Information
    Requests from staff in Advancement/LUAA – Approved by Director of
      Advancement Services Requests from other staff on campus
          o Demographic – Approved by Director of Advancement Services
          o Financial – Approved by Director of Advancement Services. If a request
              comes from a college or department, the Director will contact the college
              director of development for that area to keep them apprised.
    Requests from students
          o Greek Life – Approved by Office of Fraternity and Sorority Affairs
          o Other – Approved by Director of Advancement Services in consultation
              with student’s professor
    Requests from alumni
          o Greek related – Approved by the Assistant Vice President, Alumni
              Relations or his/her designee Regional clubs – Approved by the Assistant
              Vice President, Alumni Relations or his her designee
    Other Miscellaneous – Approved by the Assistant Vice President, Alumni
      Relations or his designee
    Requests from volunteers – Approved by Development/LUAA staff volunteer is
      working with. Will require volunteer to read and sign the Donor Bill of Rights.
      Requests from vendors (providers of services using data) – Approved by Director
      of Advancement Services in accordance with the needs of Advancement/LUAA.
      A Letter of Confidentiality must be signed by each vendor for unique projects,
      and at the beginning of each fiscal year for vendors used on a routine basis.
      These Letters of Confidentiality will be held in the office of the Director of
      Advancement Services.
    Requests from individuals
          o Personal - Upon written request of a donor and with approval of the
              Director of Advancement Services, donors may receive a printed copy of
              their giving history.
          o Others – Upon verification that requester is an alumnus/alumna, the
              person being sought is contacted provided their record is not coded in such
              a way as to preclude this. Requests for additional contact information for
              another individual shall be sent to that individual so he/she can make a
              decision as to whether to contact the requester.
    Requests from corporations and foundations
          o General – Approved by Assistant Vice President of Corporate and
              Foundation Relations and Director of Advancement Services
          o Requests regarding scholarships – Forwarded to the Financial Aid Office
    Requests from media – All such requests are forwarded to the Vice President of
      University Relations.


3
4-22-10
RLF
                          LEHIGH UNIVERSITY
                      Advancement Office Data Policy Statement
                                      April 22, 2010
      Requests from other colleges/universities – When other colleges/universities are
       seeking to locate alumni from Lehigh University and that college/university,
       approval is given by the Director of Advancement Services.
      Law enforcement agencies – Approved by general counsel
      Student loan agencies – Approved by Registrar
      Requests for statistical information – Approved by Vice President of
       Advancement




4
4-22-10
RLF
                            LEHIGH UNIVERSITY
                       Advancement Office Data Policy Statement
                                       April 22, 2010
In the event of dispute regarding the terms of this policy, the final decision shall rest with
the Vice President of Advancement or the designee of that person.

I have read and understand the policy for privacy/information security. I agree to operate
within the parameters defined herein and I further understand that violations of this
policy are subject to disciplinary measures by Lehigh University.



______________________________________                         _________________
NAME                                                           DATE




5
4-22-10
RLF