4th Annual • 2015

HEPC

The HEPC is one-day event that focuses on privacy and information management in higher education.

The event consists of a combination of speakers and smaller breakout discussion groups to foster interactivity and engagement.

Participants have a wide array of backgrounds, from higher education information officers, security officers, privacy officers, compliance officials, and general counsel.

Also attending are key individuals from industry, law firms, associations, and government regulators.

WORKSHOP

The workshop, Building a Privacy Program for Higher Education, is designed to provide participants with:

• an overview of the privacy and data security laws affecting higher education and the key things to know about them

• step-by-step guidance for developing a privacy program suitable for institutions of higher education

• detailed guidance for sharing data with cloud service providers and other third party vendors

• practical “in the trenches” wisdom about the political and logistical challenges involved with developing a privacy program at institutions of higher education

Panel, Education Privacy: A New Regulatory Paradigm?

Since FERPA in 1974, there has been scant regulatory attention on education privacy. The issue hasn’t been covered much by the media and hasn’t grabbed the public’s attention – until recently. These days, there is a dramatic shift taking place, with states passing new laws, new self-regulatory measures, several bills in Congress, a major proposal from the White House, and many NGOs starting to do more work in this area. Are we entering into new regulatory paradigm for education privacy? What would the best role for regulators be? What should new laws seek to do? What kind of reforms should be made with FERPA?

Panelists

• Kathleen Styles, Chief Privacy Officer, U.S. Department of Education
• Jules Polonetsky, Executive Director, Future of Privacy Forum
• Dipayan Ghosh, National Economic Council, Executive Office of the President
  
• Steven McDonald, General Counsel, Rhode Island School of Design

Discussion Session 1:

Education Privacy: A New Regulatory Paradigm?

In this breakout discussion session, we will discuss the issues explored in the previous panel session.

Moderators:

• Daniel J. Solove, Professor, GW Law School
• Tracy Mitrano, Principal, Mitrano & Associates, LLP
• Heidi Wachs, Special Counsel, Jenner & Block
  

Breakout Rooms 308, 310, 311

Discussion Session 2:

Cloud and Third Party Vendors

In this breakout discussion session, we will examine relationships with Cloud and third party vendors. What are the most important measures that should be taken to ensure adequate privacy/security protections in these business negotiations and contract formation with cloud providers? What level of vendor oversight is the government looking for, what level is best practice, and how does an institution focus limited resources to best reduce risk in this area?

Moderators:

• Daniel J. Solove, Professor, GW Law School
• Heidi Wachs, Special Counsel, Jenner & Block
• Rachel Krinsky, Assistant Director of Compliance/Privacy, University of Connecticut
  

Breakout Rooms 308, 310, 311

Discussion Session 3:

Dealing with a Crisis: Privacy/Security Incident Prevention and Response

In this breakout discussion session, we will discuss the best way to prevent and respond to both privacy and security incidents. What measures should be undertaken to prepare for a privacy/security incident? Should incidents involving privacy matters to be treated differently than ones involving security? How should institutions prepare for each type of incident? What kind of preventative measures should be put in place (policies, assessments, training, etc.)?
.

Moderators:

• Tracy Mitrano, Principal, Mitrano & Associates, LLP
• Susan Blair, Chief Privacy Officer, U. Florida
• Rachel Krinsky, Assistant Director of Compliance/Privacy, U. Connecticut

Breakout Rooms 308, 310, 311

Data Privacy Law 101

Daniel Solove will provide an overview of the various privacy laws that affect higher education and provide key details about complying with each.

Building a Privacy Program

Daniel Solove will discuss the components of a privacy program and how to develop them. We will explore how privacy programs work in various types of organizations and companies and how to adapt them for the higher education context.

Sharing Data with Cloud Providers and Other Third Party Vendors

Elise Dieterich, a partner at Kutak Rock LLP, with extensive privacy law experience, along with Daniel Solove and Tracy Mitrano will discuss how to share data with cloud providers and other third party vendors. What are the factors that should be looked at when evaluating the suitability of a third party? What elements that should be included in the contract? Specific and concrete guidance will be provided.

Practical Considerations for Developing a Privacy Program

Tracy Mitrano will discuss some of the practical, logistical, and political considerations involved with developing a privacy program. How can one improve “buy in” by the top administration? How can various departments and separate components of a college or university be brought together? How can one achieve participation by various members of the community – administrators, staff, faculty, students, and third parties?

This session will be informal, with ample time for group discussion.