May 19, 2003
Workshop will shed light on new 'personal identity info' law
Legislation that will take effect on July 1 will require state agencies,
including the University of California, to contact any state resident
whose personal information was, or is believed to have been, acquired
through a breach of computer security.
To prepare for these new additions to the California Information Practices
Act, spelled out in Senate Bill 1386, UCSC is in the process of developing
an implementation plan that outlines procedures in the following areas:
- Data inventory--how the campus identifies where personal identity information (e.g., name, social security number, driver's license number, bank account number) is used and stored, and who uses and has responsibility for these systems.
- Incident response process--how the campus responds to a suspected security breach.
- Notification procedures--how UCSC supplements systemwide notification procedures related to these new requirements.
- Reporting procedures--how UCSC reports such security breaches to UC's Office of the President.
To help with the development of the campus's implementation plan, UCSC
departments with computer systems that contain personal identity information
are asked to participate in an inventory of such systems. The online inventory
form can be accessed at: www2.ucsc.edu/iam/IT/PIII.htm.
The inventory is scheduled to be completed by May 30.
By June 30, all departments with such systems need to understand the procedures
that are currently being reviewed and/or developed. Toward that end, a
workshop will take place on June 4 to help department representatives
understand these procedures. The workshop will take place from 9:30-10:30
a.m. in Classroom Unit 2.
For more information, contact Chuck Piotrowski, in Information Asset Management
in the Chancellor's Office, at (831) 459-2666 or piii-info@ucsc.edu.
Related Links:
What
is SB 1386?
Campus memo re. SB 1386, from Vice Provost Larry Merkley.
What is "personal identity information" or "PII"?
What is the Information Practices Act?
