Dallas College Information Privacy & Security Program Information Classification Scheme
The College, as a public entity, is governed by the
Texas Public Information Act, which requires disclosure of information by a public body -- unless the law specifically protects that information. In general, the classification given to information is a shorthand way of determining how this information is to be handled and protected by College school officials. The information classification scheme must be reviewed annually by the College Information Security Officer.
According to the
Texas Administrative Code § 202.71, institutions of higher education are responsible for defining all information classification categories except the confidential Information category, which is defined in Subchapter A of § 202.1, and establishing the appropriate controls for each category. These classifications are defined to ensure understanding and consistency in their application.
The Texas Department of Information Resources identifies four levels of information classification in ascending degree of sensitivity. This information classification scheme should be used throughout the College as a means to identify and address the safeguards, precautions, and handling requirements necessary to prevent accidental data disclosure.
Public – Information that is freely and without reservation made available to the public.
Sensitive – Information that could be subject to release under an open records requests but should be controlled to protect third parties.
Confidential – Information that typically is excepted from the Public Information Act.
Regulated – Information that is controlled by a federal/state regulation or other third-party agreement.
Public – Category I
The lowest data classification level includes data openly available to the public. This might also include official Dallas College communications and public announcements.
Public information label is used for information such as
published reports, press releases, and information published to the Dallas College website. Such information requires no authentication and is freely distributable by all personnel.
Examples of public data
- Internet web site contents for general viewing
- Reports pertaining to public fund expenditures
- Policy statements
- Election information, including candidates' applications and campaign finance reports
- Press releases
- Public directory information
- Student directory information not marked private (per FERPA rules). NOTE: Unless you can verify that each student record has not been flagged as private, student directory information should always be considered as Sensitive - Category II information.
- Faculty and staff directory information
- Course catalog information
- Intercollegiate sports information (e.g., team rosters, statistics, scores, schedules)
- Data covered by non-disclosure agreements, service level agreements, grants, etc.
Please note that information considered public, such as employee names, birth dates, salary, and performance review information, would be released under an open records request.
Sensitive – Category II
Dallas College data not otherwise identified as confidential or regulated, but which may or may not be releasable in accordance with Open Records Requests or Texas Public Information Act (e.g., contents of specific email, date of birth, salary, etc.). Such data must be appropriately protected to ensure a controlled and lawful release (if applicable). Open records request must be submitted and approved by General Counsel office.
Much of the information is still subject to public release under an open records request, but the information should be vetted and verified before release. These types of data include items such as
employee records and gross salary information. While these records and information are considered “public” under the Texas Public Information Act, they should still be afforded a higher level of protection to ensure confidential data (e.g., net salary information) is not comingled. Submit open records requests to the General Counsel office.
Examples of Sensitive data
- Internal memorandums or e-mails
- Internal meeting minutes
- Internal (Intranet) Web sites
- Business procedures
- Student ID
- Student email address containing Student ID (e.g., ID@student.dcccd.edu)
- Employee ID
- “3x4” ID (e.g., xxx1111)
- Employee email address if not using alias (e.g., email@example.com)
- Non-public administrative or operational data
- Employee: Evaluations, Personal information, Information used to validate identity
- Asset listings and locations, building plans
- Email content, Policies, Procedures, Training Materials, Meeting information
- Non-restricted research data, Controlled unclassified data, Unpublished research work and intellectual property
- Personnel records excluding information categorized as confidential
- Student directory information marked private (per FERPA rules)
- Family information, home address, and home phone number may be released unless restricted by the employee. DCCCD employees can restrict this information by contacting Human Resources
Confidential/Regulated – Category III
This classification level is reserved for information that would, if inadvertently released, have a significant severe adverse impact to Dallas College. This data is protected specifically by federal or state law or Dallas College rules and regulations. Such information may also be subject to state or federal breach notification requirements. This category also focuses on information restricted through certain legal requirements.
Examples of Confidential/Regulated Data
- Social Security Number (SSN)
- Federal Tax Information (e.g., W-4, W-2 Forms)
- Drivers’ License Number
- Information that would give advantage to a competitor or bidder, and audit working documents
- Credit/charge/debit/access device card numbers, magnetic stripe data and security codes
- Personal financial information including financial/bank account number
- Biometric identifiers and full-face images
- Information exposing details of employee use of benefits or health information pertaining to the use of benefits
- Contract information between Dallas College and third party
- Physical plant detail
- Critical infrastructure detail
- All student records information, including grades – See Regulated – Category III
- Certain personnel records information, such as bank account/routing numbers and beneficiary information
- Certain medical and health benefit information, including medical records protected by HIPAA
- User account passwords
- Device IDs, serial numbers, IP Addresses (does not apply to public or dynamic IP Addresses)
- Attorney-client communications
- Protected draft communications
- Computer vulnerability reports
- Any other uniquely identifying number, characteristic, or code
Regulated – Category III – Expanded Explanation:
Regulated focuses on the types of data typically regulated by federal statute or third-party agreements. It is the highest level of classification and use is limited to explicitly designated or groups of individuals with a stringent business need to know. Agencies that maintain protected health, federal tax, payment card, or certain personal information will have specific requirements placed on that data by a non-Texas regulation. Regulated data has specific handling requirements unique to their applicable laws, regulations and standards not limited to:
- Federal Educational Rights and Privacy Act (FERPA)
- Gramm-Leach-Bliley Act (GLBA)
- Payment Card Industry – Data Security Standard (PCI-DSS)
- Health Insurance Portability and Accountability Act (HIPAA)
- Texas Identity Theft Enforcement and Protect Act
- Texas Public Information Statutes
- General Data Protection Regulation (GDPR)
Student Records (FERPA):
This applies to both enrolled and prospective student data.
- Grades (including test scores, assignments, and class grades)
- Bank accounts, wire transfers, payment history, financial aid/grants, student bills
- Access device numbers (card number, building access code, etc.) used to protect student records information
- Internal ID numbers (campus ID/CID)
Note that for enrolled students, the following data may ordinarily be revealed by the Dallas College without student consent unless the student designates otherwise by using Office of the Registrar approved methods:
- Student name
- Local and permanent mailing address
- Digital image (e.g., Photograph)
- Major and minor fields of study
- Participation in recognized activities and sports
- weight and height of members of athletic teams
- team photographs
- Dates of attendance
- Enrollment status
- Degree candidate
- Awards and honors received, type of award/honor
- Previous educational agencies and institutions attended
There can be confusion over which rules apply when an employee is also a student. The rule of thumb is that the student rules apply when the employee is in a student job title.
For additional examples, see
Texas Public Information Act, SUBCHAPTER C. INFORMATION EXCEPTED FROM REQUIRED DISCLOSURE.
NOTE: Please refer to the
College's Board Policies on Student Records, FJ (LOCAL) and FJ (LEGAL), definition and the handling of Student Records.
NOTE: For written requests received for Student Directory Information, notify and send to the Registrar's Office. For all other written requests, fax to College Legal. Questions regarding whether an employee has a "need-to-know" should be directed to the employee's supervisor, the location Information Security Officer, or the College Legal Counsel.
- FERPA: Family Educational Rights and Privacy Act.
- GLB: Gramm-Leach Bliley.
- HIPAA: Health Insurance Portability and Accountability Act.
- Information Classification Scheme: The classification level given to information — according to its use, sensitivity, and importance — that determines how information is to be handled and protected within Dallas College. The three categories of information are as follows:
- Category I — Public Information
- Category II — Internal Information
- Category III — Confidential/Regulated Information
- PCI: Payment Card Industry.
- School Officials: Any employees, Trustees, or agents of the College, as well as attorneys, consultants, and independent contractors who are retained by the College. School officials have a "legitimate educational interest" in a student's record when they are working with the student; considering disciplinary or academic actions or the student's case; compiling statistical data; or investigating or evaluating programs.
- USA PATRIOT Act: Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism.