6. Protection of Confidential Information
Identifying confidential information is a matter for assessment in each individual case. Broadly, however, information will be confidential if it is of limited public availability; is confidential in its very nature; has been provided on the understanding that it is confidential; and/or its loss or unauthorised disclosure could have one or more of the following consequences:
- financial loss e.g. the withdrawal of a research grant or donation, a fine by the ICO, a legal claim for breach of confidence;
- reputational damage e.g. adverse publicity, demonstrations, complaints about breaches of privacy; and/or
- an adverse effect on the safety or well-being of members of the University or those associated with it e.g. increased threats to staff or students engaged in sensitive research, embarrassment or damage to benefactors, suppliers, staff and students
Confidential information should be kept secure, by keeping it, where possible, on site using dedicated storage (e.g. file servers), rather than local hard disks, and with an appropriate level of physical security.
All users must be authenticated. Authentication should be appropriate, and where passwords are used, clearly defined policies should be in place and implemented. Users must follow good security practices in the selection and use of passwords.
The number of copies made of confidential information, whether on portable devices or media or in hard copy, should be the minimum required, and, where necessary, a record kept of their distribution. When no longer needed, the copy should be deleted or, in the case of hard copies, destroyed (see 6.12.5).
Policies and procedures must be in place for the secure disposal/destruction of confidential information The University's policy on the disposal of old computers can be found at http://www.ict.ox.ac.uk/oxford/disposal/.
The permission of the information owner should be sought before confidential information is taken off site. The owner must be satisfied that the removal is necessary and that appropriate safeguards are in place e.g. encryption. For further information, please see the Toolkit.
Email should only be used to send confidential information where the recipient is trusted, the information owner has given their permission, and appropriate safeguards have been taken e.g. encryption.
University guidance, provided via the Toolkit, on cryptographic policy and key management, should be followed to ensure that data are appropriately secured and that all legal and regulatory requirements have been considered.
A risk assessment should be carried out as part of the business case for any new ICT system that may be used to store confidential information. The risk assessment should be repeated periodically on any existing systems.
Information owners should ensure that appropriate backup and system recovery procedures are in place. Backup copies of all important information assets should be taken and tested regularly in accordance with such an appropriate backup policy.
Documents containing confidential information should be marked as ‘Confidential’ or with another appropriate designation e.g. ‘sensitive’, etc, depending on the classification system adopted by the department.
- Wherever practicable, documents with confidential information should be stored in locked cupboards, drawers or cabinets. Where this is not practicable, and the information is kept on open shelving, the room should be locked when unoccupied for any significant length of time.
- Keys to cupboards, drawers or cabinets should not be left on open display when the room is unoccupied.
- If confidential documents are sent by fax, the sender should ensure they use the correct number and that the recipient is near to the machine at the other end ready to collect the information immediately it is printed.
- If confidential documents are sent by external post, they should ideally be sent by a form of recorded delivery. The sender must ensure that the envelope is properly secured.
- If confidential documents are sent by internal post the documents should be placed in an envelope marked ‘Confidential’ with the addresse’s name clearly written on it.
There must be a written policy in place at the local level for the handling of confidential information, whether electronic or hard copy, and a copy of the procedures must be provided to every user so that they are aware of their responsibilities.
Computer security incidents involving the loss or unauthorised disclosure of confidential information held in electronic form must be reported to Oxford University Computer Emergency Response Team (OxCERT) and investigated.
If the loss or unauthorised disclosure involves personal data, whether electronic or hard copy, the University’s Data Protection Officer must also be informed, either by e-mail or by phone ((2)70002).