UW Privacy Office

Acceptable Use Standard – Husky ID Card and Husky ID Card Data

 

NOTE: The original “Acceptable Use Standard – Husky ID Card and Husky ID Card Data” was published in 2013 as a PDF document. The entire content of that PDF document has been copied onto this webpage, to provide for enhanced content accessibility.

(Approved by the Associate Vice Provost for Enrollment Services, the Vice Provost for Academic Personnel, the Associate Vice President for Facilities Services, and the Vice President for Human Resources).

Introduction

The Husky ID Card (“Husky Card”) is the official identification card for members of the University of Washington (UW) community. It is used for visual identification (photo validation) and to electronically access designated University services provided by UW academic, business and student organizations (UW Organizations). Such services include but are not limited to access to certain UW facilities, Husky Card Account debit funds, U-PASS transit, UW Libraries, and the Intramural Athletic facility.

1.    Purpose

This standard:

  • Defines the acceptable uses of the UW Husky Card including the physical card as well as the printed and electronic data associated with the card;
  • Applies to all UW campuses and locations;
  • Outlines the process to be used by UW organizations, individual cardholders and third parties in requesting authorization to access and use Husky Card data for purposes other than visually confirming the identity of the cardholder; and
  • Identifies the limitations on use of the Husky Card by the cardholder, UW organizations, and third parties.

2.    Roles and Responsibilities

a.     Data Trustees

LINK: http://www.washington.edu/uwit/divisions/im/dmc/roles/#project

  • Exercise authority over policies, procedures, and standards that govern data definitions, access, and use for data stored on the Husky Card, mirrored in the Husky Card Database, or accessed through a process enabled by the Husky Card and within their purview according to the UW Data Map.

LINK: http://www.washington.edu/uwit/divisions/im/dmc/roles/#project

  • Serve as executive sponsors of the Husky Card Advisory Committee, which provides oversight and direction on Husky Card data and use issues.

b.     Data Custodians

LINK: http://www.washington.edu/uwit/divisions/im/dmc/roles/#project

  • Implement and enforce adherence to this standard.
  • Review and authorize requests to access and use Husky Card data for purposes other than visual identification of the cardholder.
  • Provide guidance and education about this standard.
  • Submit recommendations for updates to this standard to the Husky Card Advisory Committee.

c.     Husky Card Advisory Committee (HCAC)

  • Advises the Husky Card Data Trustees and Husky Card program management on policies, practices and matters pertaining to the Husky Card program.
  • Assesses and evaluates risk factors associated with and opportunities for improvement of the Husky Card program.
  • Advises the Husky Card Data Trustees & Custodians on policies, practices and matters pertaining to data stored in the Husky Card Database, on Husky Cards, or associated with the Husky Card program.
  • Serves as a resource to campus entities considering use of the Husky Card for physical credentialing and identification. In collaboration with UW Information Technology (UW-IT), provides direction to UW organizations regarding the selection of appropriate magnetic stripe and Radio Frequency Identification (RFID) reader equipment.

d.     Husky Card Office (HCO)

  • Serves as the lead UW organization for addressing issues related to Husky Card production, management recommendations, and communication about the Husky Card program and program practice.
  • Collaborates with the HCAC, Data Custodians, and campus partners to establish appropriate policies and practices regarding the treatment of cards and card data.
  • Receives and reviews Husky Card related data requests and provides administrative support to the Data Custodians in their consideration and processing of those requests.
  • Fulfills requests for access to card-related data as authorized by the Data Custodians(s).

3.    Management and Security of Husky Card Data

a.     UW Policies and Standards in Force

  • All authorization to access or use Husky Card associated data is restricted to the use requested, and no other access, use or storage of the data is implied or may be made.
  • All data associated with the card, including records of card use, are UW data that must be stored, managed and transmitted in accordance with all applicable standards:

APS 2.2 – University Privacy Policy

LINK: http://www.washington.edu/admin/rules/policies/APS/02.02.html

APS 2.6 – Information Security Controls and Operational Practices

LINK: http://www.washington.edu/admin/rules/policies/APS/02.06.html

b.     Cardholder Terms and Conditions of Use

  • Cardholders are responsible for the care and safekeeping of their Husky Cards and the protection of information printed on or stored in the card.
  • The Husky Card is intended for the sole use of the cardholder and may not be lent to or used by individuals other than the cardholder to whom it is issued.
  • Any sale, transfer, alteration or fraudulent use of the Husky Card is a violation of UW policy and may result in disciplinary action or suspension of privileges. See:

WAC 478-121 Student Conduct Code for the University of Washington

LINK: http://www.washington.edu/admin/rules/policies/WAC/478-121TOC.html

WAC 478-124 General Conduct Code for the University of Washington

LINK: http://www.washington.edu/admin/rules/policies/WAC/478-124TOC.html

APS 47.10, “Policy on Financial Irregularities and Other Related Illegal Acts,”

LINK: http://www.washington.edu/admin/rules/policies/APS/47.10.html

c.     UW Organizations – Use of Husky Card Printed Data

  • No authorization is required for UW Organizations’ use of the Husky Card Photo, Person Name, University Identification Number (SID, EID), Person Status (e.g., Student, Employee, Retiree, etc.) for visual identification of the cardholder. Use of the printed data elements for purposes other than visual identification of the cardholder must be authorized by the appropriate Data Custodians(s).
  • Recording, storage or use of the printed transit card serial number (CSN) and/or the printed card verification number (CVN) is not allowed without the authorization of the appropriate Data Custodians.

d.     UW Organizations – Use and Limitations on Use of Husky Card Electronic Data

  • UW Organizations may not access Husky Card electronic data without obtaining the advance approval of the appropriate Data Custodians.
  • UW Organizations that are authorized to access Husky Card electronic data may read the card by authorized electronic mechanisms (card swipe or RFID reader) only for the purpose of verifying identity unless the organization has been explicitly authorized by the appropriate Data Custodians(s) to access and use other data associated with the card.
  • UW Organizations that are requesting use of Husky Card electronic data must comply with University-specified equipment and software requirements for magnetic stripe and RFID readers.
  • UW Organizations that have not been granted authorization may not capture or use Husky Card electronic data elements for any purpose.
  • UW Organizations that have been authorized to use electronic data elements for identity verification or to grant rights or privileges may not combine data derived from the Husky Card with any local data unless explicitly authorized by the Data Custodians.
  • For purposes of this standard only, the University Book Store and the University of Washington Club are considered UW Organizations.

Husky ID Card Electronic Data Access Request Form

Click here to download a Word form to request electronic data access to Husky Card data. If you have questions or accessibility needs, please contact huskycrd@uw.edu and use subject line: Electronic Data Information. (Added May, 2018)

e.     Third Party Use and Limitations on Use of Husky Card Printed or Electronic Data. Third parties may not:

  • Require presentation of a person’s Husky Card for any non-UW purpose, as card presentation for such purposes is strictly voluntary by the cardholder.
  • Access transit data contained in the ORCA RFID chip without explicit advance authorization by the Regional Fare Coordination Project (ORCA), consistent with its business rules and applicable law.
  • Access and/or store a Husky Card’s electronic or printed data elements without the written authorization of the appropriate UW Data Custodians(s). 

f.      Other Party Use of Husky ID Card Data

  • Except as authorized by the responsible Data Trustee or Data Custodian, information contained on or derived from the Husky Card and its related data will not be released to persons outside the UW except as required by law, court order or subpoena, or upon receipt of written authorization by the cardholder.

4.    Husky ID Card Data Definitions

Cardholder:  Husky Card-eligible UW employee, student, or other UW-authorized individual to whom the Husky Card is issued

Card Issue Date:  Calendar date the Husky Card is printed for use by the cardholder

Card Verification Number (CVN):  Three digit number used for Husky Card registration at the ORCA website and printed on the back of the card

Electronic Data:  The Husky Card’s Electronic Serial Number (ESN) and its Magnetic Stripe Encoding

Electronic Serial Number (ESN):  The Husky Card’s unique serial number defined by the software manufacturer

Magnetic Stripe Encoding:  The unique number encoded on magnetic stripe at the time of Husky Card printing

Person Name:  Cardholder name as entered into UW administrative system of record, and printed on the Husky Card

Person Photo:  Cardholder photo printed on the face of the Husky Card

Transit Card Serial Number (CSN):  The unique number assigned by the Husky Card manufacturer specific to the cardstock and printed on the card

UW Identification Number:  The Employee ID (EID) or Student ID (SID) number associated with the Cardholder and printed on the card.