Privacy Policy for UW Youth Programs

ON THIS PAGE:

Purpose
Scope
UW Responsibilities
Definitions
Privacy by Design
Responsible Office and Additional Information

Endorsed by the Privacy Steering Committee: June 27, 2019
Approved by the University Privacy Official: October 10, 2019

Purpose

Annually, the University of Washington (“UW”) engages with over 94,000 youth in more than 200 programs. This policy provides a foundation for protecting the privacy of youth as a more vulnerable population. Additionally, this policy supplements and further interprets the privacy requirements in UW Administrative Policy Statements 2.2 (University Privacy Policy) and 10.13 (Requirements for University and Third-Party Led Youth Programs) by helping align UW Youth Programs’ processes and procedures that involve personal data with UW values and principles for privacy.

Scope

This policy applies to a program or event that is controlled and operated by UW, as described on the Privacy and UW Youth Programs webpage (a “UW Youth Program”).

UW Responsibilities

The executive heads of major UW organizations are chancellors, vice presidents, vice provosts, deans, or other individuals with delegated executive authority from the President or Provost. These individuals are responsible for implementing processes, procedures, and delegations of authority to comply with UW policies. This includes responsibility for protecting the privacy of youth as described in UW Administrative Policy Statements 2.2 (University Privacy Policy) and 10.13 (Requirements for University and Third-Party Led Youth Programs).

Definitions

Consenting Participant: A participant in a UW Youth Program that has reached the age of eighteen to whom privacy notices should be directed and who may give privacy-related consent when solicited.
Data Processing: Any operation(s) performed on personal data, whether or not by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, access, use, disclosure by transmission, dissemination, combination, restriction, or destruction.
Personal Data: Any information that identifies or can identify an individual (either on its own or in conjunction with other information). Personal data includes the definition of Personally Identifiable Information set forth in UW Administrative Policy Statement 2.4 (Information Security and Privacy Roles, Responsibilities, and Definitions).
Youth: Any person or persons under the age of eighteen.

Privacy by Design

UW Youth Programs must embrace privacy by design, an approach for protecting personal data by embedding privacy considerations and practices throughout an organization’s operations, business processes, information systems, and technologies (including at the earliest design stage, when initiating data processing, during data processing, and when personal data is no longer needed for its original purpose).

Practices to achieve privacy by design in UW Youth Programs must include, but are not limited to, the practices identified in this policy.

Privacy Notice

Privacy notices create transparency about privacy practices, an important part of a relationship between a UW Youth Program and parents, guardians, and consenting participants. UW Youth Programs must provide the Privacy Notice for UW Youth Programs to parents, guardians, and consenting participants when personal data is first collected or as soon as feasible thereafter. More information, including instructions on how to use the Privacy Notice for UW Youth Programs, is available on the Privacy and UW Youth Programs webpage.

UW Youth Programs is responsible for ensuring that their data processing activities are consistent with and do not deviate from the privacy practices described in the Privacy Notice for UW Youth Programs.

Privacy Consent

In addition to creating awareness about privacy practices, UW Youth Programs must provide opportunities for individuals to make choices about certain data processing activities that deserve additional reflection such as direct communications with participants under the age of 13 through email or text message, etc. When obtaining consent from parents, guardians, and consenting participants, UW Youth Programs must ensure that individual choices are made affirmatively. Parents, guardians, and consenting participants should take deliberate action to indicate that they agree to a data processing activity posed for their consideration (ex. initialing, signing, ticking a box that has not been pre-ticked, etc.). When soliciting affirmative consent pursuant to this policy, UW Youth Programs must utilize the Privacy Consent Form Template for UW Youth Programs per the instructions available on the Privacy and UW Youth Programs webpage.

UW Youth Programs is responsible for ensuring that their data processing activities are consistent with and do not deviate from the consent obtained from parents, guardians, and consenting participants.

Consent obtained from parents, guardians, and consenting participants through use of the Privacy Consent Form Template for UW Youth Programs addresses UW Youth Program intellectual property rights, including any rights to (a) a participant’s likeness or voice, or (b) content created by a participant. Please note that UW Youth Programs should not use the UW Personal Release Form.

Purpose of Data Processing

Before a UW Youth Program begins any data processing, it must first reflect on the reason for which it needs the personal data it seeks. A UW Youth Program may only engage in data processing for the purpose articulated in the Privacy Notice for UW Youth Programs. Once personal data is collected, it may not be processed in ways that are unrelated to and/or inconsistent with the Privacy Notice for UW Youth Programs.

Data Minimization

A UW Youth Program must limit its data processing to the minimum needed to fulfill its original purpose. Data minimization strategies may include reducing the volume of collected personal data and collecting less-identifying data points, whenever possible. The following data points are generally not needed to fulfill the purpose of a UW Youth Program and generally should not be collected or otherwise undergo data processing:

Health insurance and/or healthcare provider information (in the event of a medical emergency, this information is not required for emergency personnel to render care);
Citizenship and/or immigration status;
Social Security number (unless required for needs-based eligibility); and
Direct contact information for minors, particularly those who are under the age of 13 (unless processed with the consent of a parent or guardian).

Commercial Data Processing

Individuals who entrust personal data to UW Youth Programs likely do so with the expectation that their personal data will not undergo data processing for financial gain or similar profit-oriented objectives. Accordingly, a UW Youth Program and any third-parties with which a UW Youth Program shares personal data (ex. a contractor) may not engage in data processing that is commercial in nature. Examples of commercial data processing are available on the Privacy and UW Youth Programs webpage.

Photographs, Video Recordings, Audio Recordings and Content Created by Participants

Photographs, video recordings, audio recordings, and content created by participants (ex. essays, stories, notes, artwork, etc.), referred to as “Identifying Content”, may be processed internally in a UW Youth Program without prior consent to:

Achieve the educational, experiential, or similar objectives pursued within a UW Youth Program; and/or
Measure and/or document a UW Youth Program’s effectiveness.

However, prior consent is required when Identifying Content is:

Published in the promotional materials (such as brochures, online content, videos) of a UW Youth Program and/or the UW;
Showcased on a UW Youth Program website, bulletin board, blog or through a similar publicly-accessible medium; and/or
Shared with a third-party (such as a funding partner) for reporting that is optional for a UW Youth Program.

Upon providing consent, individuals are unlikely to expect that Identifying Content will be indefinitely subject to external exposure. This policy establishes a finite window for external exposure with reasonable proximity to the time a participant was involved with a UW Youth Program. Identifying Content may only be published, showcased, or shared, as described above, within six years of collection (ex. with consent, a UW Youth Program may only include a participant’s photo in a promotional brochure within six years of the photo being taken).

Sharing Personal Data

To safeguard personal data, UW Youth Programs may only share or disclose personal data within or outside of UW under limited circumstances. All data processing, including internal and external sharing, must be consistent with and not deviate from the purpose and data processing activities described in the Privacy Notice for UW Youth Programs.

Sharing Personal Data Within UW

Personal data may only be shared with other units or departments at UW:

On a need-to-know basis to fulfill a UW Youth Program’s purpose for data processing and, when applicable, with prior consent; or
To comply with legal obligations, to meet UW requirements (such as UW Administrative Policy Statements and UW Presidential orders), and/or for internal UW reporting relating to health, safety, or similar interests.

Sharing Personal Data Outside of UW

Personal data may only be shared outside of UW:

With a contractor providing purpose-related services to a UW Youth Program;
As part of a legal process in response to requests by government or regulatory agencies, or in connection with a legal obligation;
To satisfy reporting requests from a third-party (such as a funding partner);
With a participant’s designated emergency contact person, emergency response personnel (such as paramedics or police), and/or healthcare providers in the event of a health or safety emergency involving the participant;
With a participant’s designated pick-up or drop-off person; or
With prior consent, when applicable.

Generally, an agreement must be in place when sharing personal data outside of UW except when shared:

As part of a legal process in response to requests by government or regulatory agencies, or in connection with a legal obligation;
To provide an assessment of or reference for a participant to a third-party (such as a letter of recommendation) at the request of a parent, guardian, or participant who is 13 years of age or older;
With a participant’s designated emergency contact person, emergency response personnel (such as paramedics or police), and/or healthcare providers in the event of a health or safety emergency involving the participant; or
With a participant’s designated pick-up or drop-off person.

To ensure adequate privacy protections are in place when a contractor processes personal data on a UW Youth Program’s behalf, a UW Youth Program should include UW’s Data Processing Agreement as an accompaniment to a main, underlying contract.

Retention of Personal Data

Personal data should only be kept as needed to fulfill the Purpose, for at least the minimum retention period established in the UW General Records Retention Schedule and/or UW Departmental Retention Schedules maintained by Records Management Services, and per applicable laws.

Security of Personal Data

All personal data maintained by a UW Youth Program must be protected with appropriate technical, physical, and administrative measures as described in UW Administrative Policy Statement 2.6 (Information Security Controls and Operational Practices).

Responsible Offices and Additional Information

This policy was jointly developed and is maintained by the Office of the Youth Protection Coordinator and the UW Privacy Office.

For additional information relating to privacy in UW Youth Programs, the implementation and operationalization of selected privacy practices described in this policy, visit the Privacy and UW Youth Programs webpage [hyperlink]. Other campus resources that may provide information or support in connection with aspects of this policy are as follows: