1
Public Information
Policy and Approval Procedures 1.0 Scope
Amity University [In] London has a responsibility for securing sensitive information against intentional or unintentional disclosure, alteration or loss of availability.
Amity University [In] London produces a variety of publications and communications for a wide range of purposes. These include promoting the School’s reputation and informing interested audiences about School activities. This policy also aims to assist staff members by clarifying where responsibility lies for School publications and communications. It intends to protect the School’s reputation and minimize the risk that sensitive information is compromised or disclosed incorrectly by defining a procedure for staff to follow to achieve consistency and accuracy.
This policy and procedure relates to information managed and/or published in electronic or printed form which cover the central administrative system (financial, HR, student related), unit administrative systems, file server, email server, web server, academic programmes, services, corporate strategy or services and activities using in the marketing and promotion of Amity University [In] London. It does not concern presentations, teaching and learning materials, staff recruitment advertisements, the results of academic research or the content of creative work.
This policy relates to all Amity University [In] London faculties, staff, students, residents, affiliates, and anyone else accessing, using or storing sensitive school information.
Amity University [In] London also has an Intellectual Property Rights, which this policy complements.
1.1 Principles
Amity University [In] London endeavours to:
1) Ensure that all sensitive information is managed securely.
2) Ensure its published information is accurate, impartial, reasonable and timely. We strive to empower external parties to construct an accurate impression of the institution and make informed decisions.
2.0 Sensitive information 2.1 Scope
This section relates to the access and use of all sensitive data (printed, electronic or web-based) from the school administrative systems.
2.2 Principles
Amity University [In] London will ensure that all access and use of sensitive data is appropriate. The school expressly forbids the access and use of sensitive data for any purpose other than the conduct of school business.
2
2.3 Guidelines for Handling Sensitive Information
When working with sensitive information the existing central administrative systems should be used.
Access to sensitive information, both in electronic and paper format, should follow the “minimum necessary” principle: an individual should have access only to the sensitive information necessary to accomplish his or her work (e.g. if Employee A needs Social Security Numbers and Employee B needs dates of birth; a spreadsheet should not be created containing names, social security numbers and dates of birth to be distributed to both employees).
The use of “convenience repositories” should be avoided. Copies of sensitive information stored in the sensitive information stored in the central administrative system should not be maintained outside of this system unless the frequency of the use of this information is such that disabling the repository would severely impact the ability of the unit to conduct its business.
Sensitive information should be disposed of properly. If a person is authorized to collect or retain sensitive information they are obligated to discard it when the information no longer has a legitimate business use. Printed or other physical materials containing sensitive information must be shredded.
Documents (e.g. spreadsheets, databases, word-processing documents) containing sensitive information must be password-protected and should be stored on network drives (“s drive”) rather than personal computer drives (“c drive”). If you do not know how to password-protect a document, or if you are uncertain which drive is your network drive, call the Information Technology Services (ITS).
In addition, if an employee cannot avoid storing documents containing sensitive information on their personal computer drives (“c drives”), then the personal computer must be “certified”. Contact the ITS for information about personal computer certification.
Physical access to paper documents containing sensitive information should be restricted to those who need the information to perform their responsibilities. Appropriate physical security, including door and cabinet locks, must be implemented. Report any accidental disclosure or suspected misuse of sensitive electronic data
immediately to the ITS and Head of School. Report any accidental disclosure or suspected misuse of sensitive information in paper format to the Head of School. When working with sensitive information, you should never:
Store documents containing sensitive information on laptop or notebook computers unless the computer is certified and the information is encrypted. Call the ITS for information about personal computer certification and encrypting data.
Store documents containing sensitive information on other mobile devices such as Personal Data Assistants (PDAs, Palms, PocketPCs, Windows CE devices, BlackBerries) unless such storage is approved by your department and the data is encrypted and the PDA is password-protected.
Store sensitive information on small portable storage devices such as floppy drives, zip disks, flash memory drives (keychain drives, flash drives. USB memory keys), CDs or DVDs unless the information in encrypted.
3
Store sensitive School information on a home computer or any other computer not certified by the School.
Provide an outside entity with any type of sensitive information without the informed consent of the Head of School. Be aggressive in seeking clarification and confirmation that including the sensitive information is essential. While this may seem obvious in the case of, for example, medical records; it applies equally to a spreadsheet containing employee names, dates of birth or social security numbers. Send any form of sensitive information off-campus via email using GroupWise or any
other email systems except Amity University [In] London Secure Email System. For information on the Secure Email System, contact the ITS.
Post any form of sensitive information on a web server. 2.4 Enforcement
Suspected or known violations of this policy will be reported to the Head of School, and may result in:
Loss of individual computer privileges.
Accountability for conduct under any applicable school policies, procedures or collective bargaining agreements, including disciplinary action.
Disconnection of non-compliant systems from the School network.
Suspected or known violations of School regulations and/or legislation will be processed by the appropriate school authorities and/or law enforcement agencies.
3.0 Public Information 3.1 Context
Public information is communicated in the framework of legislation and best practice guidelines, including:
Data Protection
Freedom of Information 3.2 Procedure
Communication of public information is authorized by the Head of School who will ensure that appropriate record keeping is followed.
There are, however, some specific categories of public information which have centralised controls:
Marketing communications
o Including Prospectuses Website and online activities
4
4.0 Marketing Communications 4.1 Scope
This section relates to all publications and advertisements (printed, electronic or web-based) expressly created to promote academic programmes to potential students and which are published via the Marketing Unit.
4.2 Principles
The Marketing Unit strives to make every feasible effort to ensure the accuracy of information in these communications based on discussion with defined individuals, units and committees within Amity University [In] London. We will present the communications to high professional standards and endeavour to follow the guidelines given in relevant codes of practice.
4.3 Prospectuses
The accuracy of prospectuses is imperative as they are of significant value to potential students. A series of sequential inspections are, therefore, undertaken to ensure the accuracy of published information. However, ensuring the prospectuses are published in a timely manner will occasionally warrant that the process of inspection is adapted to meet deadlines. These changes will be authorized by the Head of School who will make every possible effort to ensure the accuracy of the information before publication.
4.4 Responsibility for prospectus information and the process of inspection
All those involved in the various stages of checking information, by default accept responsibility being factually accurate, reasonable, verifiable and compliant with the relevant legislation. Amity University [In] London staff specified below, therefore, have joint and collective responsibility for the prospectus.
The inspection process can be divided into three stages: Stage 1
Responsibilities Staff Member
Description of academic programmes, including:
Accurate representation of the programme, modules, facilities and staff expertise.
Correct use of terminology including award titles. Impartial information regarding learning and career
outcomes that can be supported by evidence.
Accurate and appropriate use of external endorsements, professional accreditation information and quality ratings.
Correct contact details.
Accurate information regarding services provided,
5
facilities, availability of services and administrative procedures.
Information for international students
Information regarding fees, loans, bursaries, and other financial incentives
Confirmation of the approval status of award titles for programmes.
Entry requirements, application codes and admissions process.
Admission Officer
Stage 2
Overall quality of prospectus Marketing Officer
Stage3
Final inspection based on ratification of previous stages Head of School
4.5 All other publications and advertisement
Approval is sought from the relevant unit for the content of publications and advertisement. Marketing and Recruitment staff will act impartially on the basis of information provided by the relevant unit to the area described in the publication/advertisement. In all cases, where explicit approval by other units is not possible, responsibility rests with the Head of School. Faculty staff have a duty to inform Marketing and Recruitment staff of any changes which would require publications to be adapted.
4.6 Republication
Content of current Programme Specifications and Principal Course Documents can be used to support promotional publications without further checking.
Approved information (e.g. from the prospectus) can be republished without additional checks where no updated information has been received by the Marketing unit.
4.7 Directory entries
Information supplied to external organizations is subject to the inspection process above. Amity University [In] London does not have responsibility for the accuracy of information reproduced by external agencies once it has left its control. The Marketing Officer has responsibility for appointing external agencies and maintaining a list of up-to-date contacts from such agencies.
6
5.0 Website and online activities
The online prospectus is produced using the process described in 3.4. The prospectus will be updated throughout the year should there be significant changes affecting its contents. The prospectus may be updated, at the discretion of the Head of School, for more minor changes concerning its contents.
The individuals identified in Index One (below) are responsible for the accuracy of all other online information of Amity University [In] London in the areas specified and in accordance with the principles established in 1.1.
These individuals must ensure, through locally-arranged regular inspections that information is accurate and appropriate including:
Information such as third-party endorsements, ratings and rankings (e.g.’ the School has the best graduate employment record in the UK’) must be supported with reference to evidence; where possible a hyperlink to the source of the data should be supplied.
Any content must be the copyright of Amity University [In] London, or where this is not the case should be used with permission (which should be highlighted on the website).
The Marketing Officer should ensure that all links to external material are current.
Social networking sites identified as belonging to School’s teams, units or functions are managed appropriately, with processes in place to deal with user-created content.
6.0 Communication with the media
Individual staff do not have authority to have direct communication with the press and/or media. All contact must be approved by Head of School.
Press releases can only be issued by the Head of School.
Index One
Character of online information Jurisdiction
Information about faculty staff, programmes, facilities and achievements.
Head of School Information about Units including staff, research, facilities and
industry links.
Head of School Reference to fees and scholarship, bursaries and other forms of
student support.
Admissions Officer Reference to external forms of student funding, accommodation
and related services.
Admission Officer + Student Support Officer
