Home / Advanced Topics / Wufoo Forms / Information Privacy Training

Online Forms and Information Privacy Training

This training is specifically designed for individuals creating forms via WuFoo or Google Forms.  Google Forms offers lesser functionality but greater security because Google has signed the data security terms we require. 

See the glossary of UCSC IT Policy-Related Terms for the official UCSC definitions of restricted and confidential information which have since been replaced by the concepts of Protection Level and Availability Level ratings.

Summary of Information Privacy Rules for Creating Forms 

  • Restricted Information: No restricted data can be collected by any form.  See below for definitions and examples
  • Confidential Information: Use judgment when requesting information that could be considered confidential. See below for examples.
  • Student Information:  See below for definitions and examples.
    • Forms that request student information from a third party should not be created with WuFoo because the person entering the data may or may not know whether the student has filed a non-release of information (NRI).  Google forms may be used for this purpose.
    • Forms requesting public information from the student themselves are acceptable.  
    • Forms requesting confidential student information are acceptable in Google forms only.

 

No restricted data can be collected by any form.

Definition of Restricted Information

"Restricted information" is UC's term for the most sensitive confidential information. Restricted information or data is any confidential or personal information that is protected by law or policy and that requires the highest level of access control and security protection, whether in storage or in transit.

Examples of Restricted Data

  • Personal Identity Information (PII)
  • Electronic protected health information (ePHI) protected by Federal HIPAA legislation
  • Credit card data regulated by the Payment Card Industry (PCI)
  • Passwords providing access to restricted data or resources
  • Information relating to an ongoing criminal investigation
  • Court-ordered settlement agreements requiring non-disclosure.
  • Information specifically identified by contract as restricted.
  • Other information for which the degree of adverse effect that may result from unauthorized access or disclosure is high.

Personal Identity Information (PII) Definition

Personal identity information (PII) is the electronic manifestation of an individual’s first name or first initial, and the last name, in combination with one or more of the following*:

  • Social Security Number (SSN)
  • Driver's license number, or State-Issued ID card #
  • Account number, credit or debit card number
  • Medical information
  • Health insurance information

*Please note, this is a condensed list. For a complete definition please see our online glossary.

 

Forms that Collect Confidential Information

WuFoo forms are not to be used to collect FERPA-protected data. Use judgment when requesting other types of confidential information.

The term “confidential information” applies broadly to information with some level of sensitivity for which unauthorized access to or disclosure could result in an adverse effect.  Google forms may be more acceptable because Google has signed the data security agreement with UCSC.

Note: Student confidential information is special category protected by FERPA. See below for details.

Examples of Other Types of Confidential Information

  • Home address or home telephone number
  • Personal information protected by anti-discrimination and information privacy laws such as:
    • Ethnicity or Gender
    • Date of birth
    • Citizenship
    • Marital Status
    • Religion or Sexual orientation
  • Certain types of student records (see below)
  • Exams, answer keys, and grade books
  • Applicant information in a pending recruitment
  • Information subject to a non-disclosure agreement, including research data, intellectual property (IP), patent information and other proprietary data
  • Academic evaluations and letters of recommendation
  • Responses to a Request for Proposal (RFP) before a decision has been reached
  • Some kinds of personnel actions
  • "Pre-decisional" budget projections for a campus department (can also be marked "Draft" or "Not for Distribution")

Rules for Creating Forms that Collect Student Information

  • Forms that request student information on behalf of the student should not be created with WuFoo because the person entering the data may or may not know whether the student has filed a non-release of information (NRI).  Google forms may be used for this purpose.
     
  • Forms requesting information from the student themselves for public information are acceptable.  
  • Forms requesting confidential student information are not acceptable.

The disclosure of information from student records is governed by FERPA. Even though student records are not considered restricted data, it's important to know about rules governing their disclosure.

Public Student Information Defined

The campus has defined the following as public information which may be disclosed to third parties without the consent of the student UNLESS the student has requested Non-Release of Public Information (NRI) through the Academic Information System.

  • student's name
  • local telephone
  • local address (current mailing or campus/college)
  • campus e-mail address
  • college, division, department
  • major, minor
  • class level (e.g., frosh, senior)
  • dates of attendance
  • number of credits enrolled in the current term
  • degrees and honors received
  • name, weight, and height of participants on intercollegiate athletic teams

Confidential Student Information Defined

All other information contained in a student record is considered confidential. It may not be shared or disclosed beyond "business need to know" within the University. Our agreement with Google covers us for FERPA-protected data, including the types of information below. The forms shouldn't be set up to email non-public info in plain text. This includes but is not limited to:

  • grades or GPA
  • number of credits completed
  • Social Security number
  • student number
  • anticipated graduation date
  • date of birth
  • student schedule

All information for students with an NRI (FERPA flag) is considered confidential, including the fact that they are a student.

Note: There is no equivalent to an NRI flag for staff or faculty.

At UCSC, the Registrar is the authoritative office for FERPA. Refer to the Registrar's Web site for additional information: http://registrar.ucsc.edu/records/privacy/