Law / United States / 
South Dakota
Board of Regents personally identifiable information and Social Security number policies
South Dakota Board of Regents Policies 5.14 and 7.7
In force.
A sensitive categories rule binding government bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Access restriction, Prohibition, Security
What it requires
- If you are a Board of Regents institution, use or share personally identifiable information only on a minimum necessary basis, only with individuals authorized to use it as part of their official duties, and without further disclosure unless the data trustee authorizes it (BOR Policy 7.7, part C(1.1)).
- Collect personally identifiable information only as necessary for academic and business needs, restrict its distribution, secure it with safeguards such as secured file storage, encryption and access controls, and dispose of it through approved secure means such as shredding and erasing hard drives and other media (BOR Policy 7.7, part C(2.1)).
- Share personally identifiable information with a third party only on a need-to-know basis consistent with law and with adequate protections, under a written confidentiality agreement signed by both parties that keeps the information secure, limits its use to a specific authorized business purpose and provides for its destruction by approved methods when the agreement ends (BOR Policy 7.7, part C(2.2)).
- Do not use Social Security numbers for regular identification or routine personal authentication, and do not display or encode them on identification cards; assign each person a unique student or employee identification number as the alternative (BOR Policy 5.14, parts C(2.1) and C(2.2)).
- Transmit, store and process the Social Security numbers you collect for authorized purposes in a secure manner, encrypting when possible, and limit access to authorized individuals for authorized purposes (BOR Policy 5.14, parts C(2.4) and C(3.1)).
- Do not disclose an individual's Social Security number to anyone outside the System except as allowed by law or upon proper written permission of the individual (BOR Policy 5.14, part C(3.1)).
These lines are LexLint's reading of the law's text.
What this law does
Section 13-53-4 of the South Dakota Codified Laws gives the Board of Regents power to enact and enforce all rules and regulations deemed necessary for the management of the institutions under its control and for the government of students and employees in them. Section 13-49-13 provides that, unless a statute expressly provides otherwise, the Board of Regents shall govern and regulate each institution under its control.
Board of Regents Policy 7.7 requires personally identifiable information to be used or shared only on a minimum necessary basis and only with individuals who are authorized to use it as part of their official university duties. Policy 7.7 requires each organizational unit to dispose of personally identifiable information through approved secure means such as shredding and erasing hard drives and other media.
Policy 7.7 requires personally identifiable information provided to third parties to be governed by written confidentiality agreements signed by both parties, including provisions to have the information destroyed by approved methods when the agreement ends. Policy 7.7 includes student education records as defined by the Family Educational Rights and Privacy Act in the personally identifiable information it covers.
Board of Regents Policy 5.14 provides that Social Security numbers shall not be used for regular identification or routine personal authentication purposes. Policy 5.14 provides that Social Security numbers shall not be displayed or encoded on identification cards. Policy 5.14 requires Social Security numbers collected for authorized purposes to be transmitted, stored and processed in a secure manner, encrypting when possible.
Policy 5.14 states that reports containing Social Security numbers should always be encrypted and destroyed when no longer needed. Policy 5.14 provides that the institutions shall not disclose an individual's Social Security number to anyone outside the System except as allowed by law or upon proper written permission of the individual.
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .
us-sd-south-dakota-board-regents-policies-5-14-7 ; PII