Policy identification number: IT-0005
File: Information Technology Policies
Acceptable Use of Student and Employee Identification Numbers
This policy establishes the requirements and restrictions regarding the use of Student or Employee Identification numbers.
Vice President, Finance & Administration
June 10, 2019
June 10, 2019
acceptable, identification, numbers, a
Scheduled for Review
I. Policy Statement
All faculty, staff, employees, and departments of Fort Lewis College are expected to adhere to the following guidelines regarding the use of Student and Employee ID numbers:
II. Reason for Policy
Colorado State statutes identify Employee and Student ID numbers as Personally Identifiable Information. Per the statute, reasonable security procedures and practices must be implemented and maintained to protect these data elements against unauthorized access or use. Additionally, the Federal Fair Credit Reporting Act require that appropriate measures are implemented to prevent identity theft.
For following the policy: All employees and contracted vendors
For enforcement of the policy: Information Security Officer
For oversight of the policy: Vice President for Finance & Administration
For notification of policy: Policy Librarian
PII: Personally Identifiable Information is defined in the “Classification of Data” policy.
Stand-alone fashion: This refers to the use of an individual’s name and Student or Employee ID without any additional verification factors.
Verification factor: This is information or a mechanism that can be used to verify the identity of an individual, such as passwords or photo ID cards.
V. Cross-Referenced Policies
Classification of Data Policy
Colorado Revised Statutes C.R.S. § 24-73-101
The Fair Credit Reporting Act, Part 681 “Identity Theft Rules”
U.S. Department of Education: FERPA Online Library
VI. Consequences of Non-Compliance
Using Student and Employee numbers improperly puts individuals at risk of identity theft and financial fraud. Fines and penalties for improper use and management of Personally Identifiable Information can be levied by State, Federal, and International entities.
Violations shall be handled consistent with College disciplinary procedures. The College may refer suspected violations of applicable law to appropriate law enforcement agencies.