{"id":569,"date":"2019-01-04T13:19:32","date_gmt":"2019-01-04T18:19:32","guid":{"rendered":"http:\/\/it.rutgers.edu\/scarletapps\/?page_id=569"},"modified":"2026-06-04T12:21:21","modified_gmt":"2026-06-04T17:21:21","slug":"acceptable-use-policy","status":"publish","type":"page","link":"https:\/\/it.rutgers.edu\/scarletapps\/acceptable-use-policy\/","title":{"rendered":"Acceptable Use Policy"},"content":{"rendered":"
\n\n
\n \n
\n
\n
\n
\n\t\t\t\t

Acceptable Use Policy<\/h1>\n\n<\/div>\n\t\t\t\t
<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n<\/div>\n\n <\/section>\n\n\n
\n\n
\n
\n \n

Google Apps for Education suite, known locally as ScarletApps, is available for students, faculty, and staff. ScarletApps provides a convenient array of tools for communicating and sharing information. Contractual terms and conditions have been negotiated that protect the privacy and confidentiality of data associated with the core suite of Google Apps for Education (i.e. Gmail, Calendar, Docs, Sites, Video). While this agreement provides a measure of protection, it\u2019s important to remember that privacy and security remain the individual\u2019s responsibility and that email, by its nature, is not a secure medium for sharing sensitive information.<\/p>\n

The implementation of Google Apps provides an opportunity to remind ourselves of the various policies, guidelines, and regulations concerning the handling of private and sensitive data. While these apply to Google, they also apply to email systems in general, as well as third party and cloud services.<\/p>\n

Acceptable Use<\/strong><\/h2>\n

Google Apps services should be used responsibly and in accordance with the University\u2019s\u00a0Acceptable Use Policy for Computing and Information Technology Resources<\/a>\u00a0(70.1.1). Google Apps may be used for conducting university activities appropriate to an individual\u2019s role at the University provided it is in compliance with the Acceptable Use Policy, the\u00a0Information Security Classification Policy<\/a>\u00a0and the following regulations and data use restrictions.<\/p>\n

\n \n \n \n \n <\/colgroup>\n <\/table>\n \n \n \n<\/div>\n\n

Export Controlled Information: Guidelines<\/strong><\/h2>\n

Export controlled information is not permitted in Rutgers Google Apps (or other cloud services). It can be a federal crime to share export-controlled information with collaborators who are not United States citizens or permanent United States residents. The Office of the Vice President for Research and Economic Development has issued\u00a0guidelines<\/a> for export-controlled information. Please note that email, by its nature, is an unsecure medium for sharing sensitive information. Just as you wouldn\u2019t include your Social Security number or credit card number in an email message, you should not include export-controlled data in email. Export controlled data are legally protected and of high consequence.<\/p>\n

Financial Data \u2013 Gramm-Leach Bliley Act (GLBA)<\/strong><\/h2>\n

The\u00a0Gramm-Leach-Bliley Act (GLBA)<\/a>\u00a0includes provisions to protect consumers personal financial information held by financial institutions. The University is obligated by federal regulation and policy to protect this data. Communication of financial aid or payment of fines may be subject to GLBA requirements. The GLBA working group is currently responsible for managing this effort.\u00a0Learn more about the Gramm-Leach-Bliley Act<\/a>.<\/p>\n

Health Information \u2013 Health Insurance Portability Accountability Act (HIPPA) and Protected Health Information (PHI) Data<\/h2>\n

Email should not be used to store or transmit protected health information (PHI). Individually identifiable health information is legally protected by Federal HIPAA Privacy and Security laws as well as New Jersey State regulations. All question or concerns regarding HIPAA or protected information should be directed to the Office of Student Affairs Compliance<\/a>.<\/p>\n

Human Subject Research Data<\/strong><\/h2>\n

Human Subject Research data is a body of personally identifiable data elements collected in the course of research with living human beings. Human Subject Research regulations require adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data to limit access from external third parties, including vendor services administrators. For more information visit\u00a0Protection of Human Research Subjects, IRB<\/a>\u00a0and\u00a0OHRP<\/a>\u00a0for regulatory guidance.<\/p>\n

Intellectual Property: Collaboration Use<\/strong><\/h2>\n

Google Apps (or other cloud services) users may use collaboration tools to view data, co-edit documents, etc. It is the responsibility of each user to ensure that appropriate sharing controls are used in order to protect Rutgers intellectual property or third party confidential proprietary information provided to the university under contractual terms requiring non-disclosure. Details of intellectual property use are in the\u00a0Rutgers Copyright Policy<\/a>.<\/p>\n

Payment Card Industry (PCI) Information<\/strong><\/h2>\n

The Payment Card Industry Data Security Standard (PCI-DSS) requires entities processing credit card transactions to enforce stringent security requirements for stored credit card information. These requirements apply to third party service providers including Google. Cardholder data is defined as the full magnetic stripe or the Primary Account Number (PAN) plus any of the following: Cardholder name, Expiration date, and Service Code. Visit the\u00a0Information Security Office\u2019s information on the Payment Card Industry (PCI)<\/a>\u00a0and the\u00a0Credit Card Acceptance policy<\/a><\/p>\n

Personally identifiable Information: New Jersey Identity Theft Prevention Act<\/strong><\/h2>\n

The\u00a0New Jersey Identity Theft Prevention Act<\/a>\u00a0is a state law that limits the use and display of certain personal information and requires Rutgers and other businesses to notify New Jersey consumers if this information has been compromised. \u201cPersonal information\u201d is defined as the first name or first initial and last name linked with any one or more of the following data elements: (i) social security number; (ii) account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual\u2019s financial account, (iii) State identification card number, (iv) driver\u2019s license number, (v) date of birth. According to state law and University policy business units and individuals shall not store or transfer data containing personal information to another unit, private entity or public entity over the network unless it meets a valid business purpose and a secure network transmission is used.<\/p>\n

Student Educational Records \u2013 The Family Educational Rights and Privacy Act (FERPA)<\/strong><\/h2>\n

FERPA<\/a>\u00a0is a federal law that protects the privacy of student education records. Student data protected by FERPA is permitted in the Rutgers Google Apps services provided that the information is shared only between the student and those who have a legitimate education-related interest.<\/p>\n

Google Privacy and Security<\/strong><\/h2>\n

For an explanation of Google privacy and security policies, see\u00a0Google Security and Privacy for Schools<\/a>\u00a0and their general\u00a0Security and Privacy<\/a>\u00a0page.<\/p>\n<\/div>\n\n <\/div>\n