Author: Gina Riggs

Sensitive personally identifiable information (PII) is typically information that individuals would consider private or that could cause harm to them if unauthorized access and use occurred. The problem is that most of the technological world relies on personal information to provide a service to customers. This information is usually protected by certain regulatory or legal requirements which necessitates a certain level of data security practices to be implemented to maintain the confidentiality, integrity and availability of the data.

The volume and type of sensitive data you manage is directly linked to the costs associated with protecting it. Implementing legal and regulatory requirements for such data significantly contributes to these expenses. Additionally, holding large amounts of sensitive PII across multiple locations increases the risk of becoming a target for malicious actors who seek to monetize sensitive data for illegal purposes.

To address these challenges, it is crucial to collect or access sensitive data only when there is a legitimate purpose and to minimize its use and storage wherever possible. WSU Policy 19.01 / Acceptable Use outlines specific restrictions on storing sensitive information, such as Social Security numbers or credit card data, to help mitigate these risks. Take a look at your OneDrive or through email. What kinds of sensitive PII are being collected in there that no longer need to be?

For more information visit the WSU Privacy SharePoint Site. For any privacy related questions or concerns, reach out to the privacy officer at privacy@wichita.edu or via phone at 316-978-4447 (4HIP).

Personally identifiable information (PII) can be defined as information about an individual that can be used to distinguish or trace an individual’s identity. Examples include names, social security numbers, date and place of birth or biometric records and any other information that is linkable to an individual, such as medical, educational, financial or employment records.

Privacy laws and regulations are typically more focused on protecting the types of PII that are considered sensitive. These can include standalone sensitive PII (e.g., financial, social security, driver’s license or passport numbers or biometric records) or sensitive information that becomes identifiable because an identifier is linked to it (e.g., medical educational, financial, income tax or employment records). A definition of what WSU considers PII can be found in the WSU Policy 19.20: Data Sensitivity Classification.

For more information visit the WSU Privacy SharePoint Site. For any privacy related questions or concerns, reach out to the privacy officer at privacy@wichita.edu or via phone at 316-978-4447 (4HIP).

Privacy is the ability to exercise control over one’s information. This is supported through understanding how, when and why personal data is collected and used. It is a complex issue that is broader than confidentiality, and related to, but sometimes in direct conflict with, data security. Privacy includes additional principles like data minimization, data subject rights, purposeful and ethical use, consent and notification.

Privacy laws typically focus on preservation of privacy when it comes to personally identifiable information or personal identifiable information (PII). For more information about PII, check out tomorrow’s data privacy topic.

For more information about what privacy is, visit the WSU Privacy SharePoint Site. For any privacy related questions or concerns, reach out to the privacy officer at privacy@wichita.edu or via phone at 316-978-4447 (4HIP).

To celebrate Data Privacy Week, which takes place Jan. 27-31, each day the WSU Privacy Office will share different data privacy topics or resources with you. In addition, the National Cybersecurity Alliance is providing free events with registration and additional resources about data privacy, which can be accessed at a link posted on the WSU Privacy SharePoint site.

For any privacy related questions or concerns, reach out to the Privacy Officer at privacy@wichita.edu or via phone at 316-978-4447 (4HIP).

The AI boom has brought about many new, free products to the community. Information security has been investigating these AI driven products and how they represent themselves is not always what you expect.

Examples include:

• When you accept the terms and conditions to use the free model, any emails, text or chat messages, pictures and videos on the device can be collected and used to train, regardless of the sensitivity.
• Messaging, audio and video is being used to infer and report out a possibly inaccurate picture of an individual’s engagement and participation in meetings.
• Personal information collected in these systems is being sold to outside entities or reused without consent.

Is there an AI assistant you want to use? If so, reach out to the to the Data Management Committee by email at DataTransferReview@wichita.edu before engaging with free services. “Free” often means data, sensitive or not, becomes their data. Often times, ITS has cheaper, better and safer integrated solutions.

For more information on the safe and ethical use of generative AI, visit WSU Generative AI Guidelines.​

A social security number (SSN) is a very sensitive piece of identifiable information, and when it falls in the wrong hands, it can put you at risk for identity theft and lead to:​

• A credit card being opened and used under your name leaving you with large amounts of debt and a poor credit score​
• Your tax refund benefit being stolen​
• Your social security or medical insurance benefits being stolen

Email is not always a secure form of transfer and should never be used to transfer SSNs. As WSU Policy 19.01 states, SSNs should not be stored on university and personal devices, which includes email storage.​

For questions about how to safely transfer this type of sensitive information, email askinfosec@wichita.edu.