UW Privacy Office

Youth Programs

Annually, the University of Washington (“UW”) engages with over 94,000 youth in more than 200 programs. The Office for Youth Programs Development and Support and the UW Privacy Office jointly developed the policy and related resources that appear below as a privacy framework for youth as a more vulnerable population.

Privacy Policy for UW Youth Programs
Privacy Resources for UW Youth Programs

Providing the Privacy Notice for UW Youth Programs
Soliciting Consent for Certain Data Processing Activities
Frequently Asked Questions

Glossary of Privacy Terms

Privacy Policy for UW Youth Programs 

The Privacy Policy for UW Youth Programs supplements and further interprets the privacy requirements in UW Administrative Policy Statements 2.2 (University Privacy Policy) and 10.13 (Requirements for University and Third Party Led Youth Programs).

Applicability

The Privacy Policy for Youth Programs applies to certain programs or events that primarily target youth and are controlled and operated by the UW, as described below.

For the purpose of the policy and related resources, “UW Youth Programs” independently make decisions about and/or determine the means and purpose of their program or event (including administration, operations, activities, personal data processing, etc.).

UW Youth Programs may include a variety of programs and events such as college readiness and tutoring programs, sports clinics, and summer camps, among others. UW Youth Programs must embrace privacy-by-design by aligning their practices with the policy and the related resources that appear below.

Notably, the policy does not apply to programs or events that involve:

  • A general audience with people of all ages (such as graduation ceremonies and football games);
  • Youth who are supervised by a parent, guardian, teacher, or other non-UW chaperone;
  • Students who are admitted to the UW or registered in courses offered by a UW academic program;
  • Personal data collected from individuals in the European Economic Area;
  • Human Subjects who participate in IRB-approved research;
  • Patients who receive healthcare services;
  • Only renting or making available UW facilities to non-UW organizations that primarily target youth; and/or
  • Non-UW organizations that jointly (with UW) or solely make decisions about and/or determine the means and purpose of the program or event (including its administration, operations, activities, personal data processing, etc.)

For studies or evaluations that are neither IRB-reviewed nor approved, please contact the Office for Youth Programs Development and Support via email at uwminors@uw.edu for additional guidance.

If you are unsure whether your program or event must follow the policy and use the related resources that appear below, please consult the Frequently Asked Questions  below or contact the Office for Youth Programs Development and Support via email at uwminors@uw.edu for assistance. 

Privacy Resources for UW Youth Programs

To operationalize the youth-related privacy protections described in the Policy, UW Youth Programs must:

  • Align their practices with the policy;
  • Utilize the Privacy Notice for UW Youth Programs;
  • Utilize the Privacy Consent Form Template for UW Youth Programs; and
  • Explore privacy considerations in the Frequently Asked Questions.

Providing the Privacy Notice for UW Youth Programs 

Privacy notices create transparency about privacy practices, an important part of the relationship between a UW Youth Program and its constituents. UW Youth Programs must provide the Privacy Notice for UW Youth Programs to parents, guardians, and participants who have reached 18 years of age when personal data is first collected or as soon as feasible thereafter.

Steps for Using the Privacy Notice for UW Youth Programs

Step 1: Understand privacy-related commitments and obligations.

  1. Read through the Privacy Notice for UW Youth Programs to understand the privacy-related commitments made to parents, guardians, and participants who have reached 18 years of age
  2. Ensure your data processing activities are consistent with the statements in the Privacy Notice for UW Youth Programs

Step 2: Provide the Privacy Notice for UW Youth Programs.

  • Use the most current version of the Privacy Notice for UW Youth Programs by:
    • Printing the .pdf version [download] of the Privacy Notice for UW Youth Programs immediately before dissemination (it will be current as of the date of your download);
    • Including a visible and prominent link to the Privacy Notice for UW Youth Programs on any webpage where personal data is collected in connection with a UW Youth Program; and/or
    • Including a visible and prominent link to the Privacy Notice for UW Youth Programs in the body of email messages through which your UW Youth Program collects personal data.
  • Keep the Privacy Notice for UW Youth Programs distinct and separate from other materials that your UW Youth Program may disseminate.
  • No action is required from individuals who receive or access the Privacy Notice or UW Youth Programs (it is informational only).

Step 3: Review and monitor.

  • Document when and how the Privacy Notice for UW Youth Programs was provided or made available.
  • Continually assess and confirm that all personal data processing activities in your UW Youth Program align with the Privacy Notice for UW Youth Programs.

Soliciting Consent for Certain Data Processing Activities

In addition to creating awareness about privacy practices, UW Youth Programs must provide opportunities for parents, guardians, and participants who have reached 18 years of age to make choices about certain data processing activities that warrant additional reflection.

UW Youth Programs must utilize the Privacy Consent Form Template for UW Youth Programs (click to download as a Word document). When obtaining consent, UW Youth Programs must ensure that individual choices are made affirmatively. See the Frequently Asked Questions below for more information about affirmative consent.

Steps for Creating and Using a Privacy Consent Form

Step 1: Determine which data processing activities require consent.

  • Read the Privacy Notice for UW Youth Programs and determine whether any data processing activities in your UW Youth Program require consent.
  • If any data processing activities require consent, proceed to Step 2. 
  • If no data processing activities require consent, no further action is required.

Step 2: Create a customized privacy consent form for your UW Youth Program.

  • Read the Privacy Consent Form Template for UW Youth Programs which includes sample text that you can repurpose;
  • Delete any boxes with text describing data processing activities that do not occur in your UW Youth Program;
  • For any of the remaining boxes that contain bulleted descriptions of personal data, delete bullet points that do not apply to your actual data processing (if any);
  • Populate all yellow-highlighted placeholders based on the nature of your UW Youth Program’s data processing activities;
  • Make cosmetic and formatting revisions only (no substantive changes), as needed;
  • Delete template instructions contained in track comments; and
  • Finalize your UW Youth Program’s privacy consent form.

Step 3: Solicit consent using your UW Youth Program’s finalized privacy consent form.

When to solicit consent

  • Solicit consent when your UW Youth Program provides the Privacy Notice for UW Youth Programs; or
  • Any time after providing the Privacy Notice for UW Youth Programs but before engaging in the data processing activity described in your finalized privacy consent form (i.e., ‘just-in-time’ consent).

How to solicit consent

Your finalized privacy consent form must be distributed to parents, guardians, and participants who have reached 18 years of age through one of the approaches described below. Regardless of your selected distribution method, the text of your finalized privacy consent must be distinct and separate from any other materials your UW Youth Program may disseminate.

  • Paper: Print and manually distribute your UW Youth Program’s finalized privacy consent form. Collect completed and signed consent forms.
  • Email: First, make your finalized privacy consent form available online as a downloadable Word document or .pdf file. When sending your email solicitation, include a link to your UW Youth Program’s finalized privacy consent form. Ensure that individuals are not required to log into any account in order to access your finalized privacy consent form. Ask email recipients to download, print, sign, scan, and return their consent forms via email.
  • Webpage or Online Tool: Your webpage or online tool must display the text from your UW Youth Program’s finalized privacy consent form. Be sure that (a) individuals are not required to log into any account in order to access your consent solicitation, and (b) a date and time stamp is digitally affixed to each submission. Use the modified language that appears in italics below and, in place of the manual check boxes in the Privacy Consent Form Template, use online check boxes that are unchecked as a default.

Before clicking “Submit” below, please confirm the following:

    • I have read and understood the Privacy Notice for UW Youth Programs available at https://www.washington.edu/privacy/notices/youth/;
    • I understand that I am not required to give my consent; and
    • I agree to the processing described above for which I marked “Yes, I give my consent”.

Participant’s name: __________________________ 

Parent or guardian’s name (if participant is not yet 18): __________________________ 

[Submit Button] 

Step 4: Store and document consent obtained from individuals.

    • Securely store completed consent forms and online submissions.
    • Document when and how prior consent was solicited and obtained by your UW Youth Program

Step 5: Honor individual consent.

    • Identify the population that has actually given consent and limit the related data processing activities to just that population.
    • Be sure an individual’s consent is honored throughout all aspects of your UW Youth Program’s personal data processing.

 

Frequently Asked Questions

General Questions

Who was involved in developing the Privacy Policy for UW Youth Programs and related resources?

The Privacy Policy for UW Youth Programs and related resources were developed by the Office for Youth Programs Development and Support and the UW Privacy Office in consultation with the UW Division of the Attorney General’s Office and UW Compliance and Risk Services; reviewed by a focus group of UW Youth Programs and enhanced based on their feedback; and endorsed by the Privacy Steering Committee.

What constitutes personal data?

Personal data is any information that identifies or can identify an individual (either on its own or in conjunction with other information) such as:
• Name;
• Date of birth;
• Level of education;
• The school a participant attends; or
• Parent or guardian contact information.

Personal data can exist in any format, including:
• Hard copy or paper formats;
• Electronic or digital formats;
• Photographs;
• Video recordings; or
• Audio recordings.

What is a consenting participant?

A consenting participant is a participant in a UW Youth Program who has reached eighteen years of age. UW Youth Programs may provide the Privacy Notice for UW Youth Programs and any consent forms developed using the Privacy Consent Form Template directly to a consenting participant.

What are examples of prohibited commercial data processing?

Examples of prohibited commercial data processing may include:
• Marketing of commercial goods or services to individuals;
• Use of an individual’s personal data to develop or improve a commercial good or service that does not yield a tangible benefit to participants in or operators of a UW Youth Program; and
• Sale or brokering of an individual’s personal data.

What is an example of data minimization?

A UW Youth Program should identify strategies to minimize the amount of personal data it collects and, when possible, obtain less-identifying data points.

For example, a registration form may ask for a participant’s age and date of birth when an age range (ex. 5-8 years of age) could sufficiently inform age suitability for a UW Youth Program and be less identifying.

How can my UW Youth Program provide notice to and solicit consent from parents, guardians, or consenting youth who are English language learners?

UW Youth Programs may engage a qualified translator to make the Privacy Notice for UW Youth Programs and any consent forms developed using the Privacy Consent Form Template available in other languages. Translations must be materially the same as the English language originals. UW Youth Programs are responsible for the integrity of any translations.

How long does my UW Youth Program have to align its practices with the Privacy Policy for UW Youth Programs and the related resources?

For many UW Youth Programs, aligning practices with the Privacy Policy for UW Youth Programs and the related resources may require changes to existing operations and business processes. Accordingly, UW Youth Programs have until October 31, 2020 to fully implement the practices and principles identified in the Privacy Policy for UW Youth Programs and the related resources.

Privacy Policy for UW Youth Programs and Applicability

My UW Youth Program engages with contractors who provide services on behalf and at the instruction of my UW Youth Program. Does my UW Youth Program still need to follow the Privacy Policy for UW Youth Programs and use related resources?

Yes. A UW Youth Program that independently makes decisions about and/or determines the means and purpose of their program or event (including administration, operations, activities, personal data processing, etc.) must follow the Privacy Policy for UW Youth Programs and use the related resources even if it engages with contractors.

My UW Youth Program reports personal data to a non-UW organization (such as a funding partner) that otherwise has no role in the control or operation of my UW Youth Program. Does my UW Youth Program still need to follow the Privacy Policy for UW Youth Programs and use related resources?

Yes. A UW Youth Program that independently makes decisions about and/or determines the means and purpose of their program or event (including administration, operations, activities, personal data processing, etc.) must follow the Privacy Policy for UW Youth Programs and use the related resources even if it reports personal data to non-UW organizations that otherwise have no role in the control and operations of its UW Youth Program.

What are examples of programs or events intended for a general audience?

Examples of general audience events are graduation ceremonies and football games that welcome attendees of all ages.

What is an example of a program or event that hosts youth who are supervised by a parent, guardian, teacher, or other non-UW chaperone?

An example of hosting youth with a non-UW chaperone is a 7th grade class field trip to the Burke Museum in which visiting youth are supervised by their school teacher and personal data relating to the visiting youth is not collected by UW.

What is an example of a program or event for youth who are admitted to the UW or registered in courses offered by a UW academic program?

An example of a program or event intended for youth who are admitted to the UW or registered in courses offered by a UW academic program is an early entrance program in which 10th grade students withdraw from high school and enroll at UW.

What are examples of programs or events that collect personal data about individuals in the European Economic Area?

An example of a program or event that collects personal data about individuals in the European Economic Area is a global language learning program in which youth located in Spain, Italy, and France are tutored via video conferencing.

What are examples of non-UW organizations that jointly (with UW) or solely make decisions about and/or determine the means and purpose of a program or event (including its administration, operations, activities, personal data collection and use, etc.)?

An example of a non-UW organization that jointly makes decisions about and/or determines the means and purpose of a youth-focused program with UW is a third-party partner of a UW-based tutoring program that co-brands the initiative with UW; designs registration forms, curricula, tutoring strategies, and metrics for participant evaluation with UW; assigns its staff and volunteers to work alongside UW staff and volunteers with youth; and shares access to program databases containing participants’ personal data to administer the tutoring program with UW operators.

An example of a non-UW organization that solely makes decisions about and/or determines the means and purpose of a youth-focused program or event is a third-party summer camp that contracts with UW to provide staffing on its behalf and at its direction.

The Privacy Policy for UW Youth Programs does not apply to my program or event. Is there anything my program or event should do to address youth privacy?

Depending on the nature of your program or event and/or your program or event’s involvement with third-parties, you may consider adopting and implementing some of the principles and practices detailed in the Privacy Policy for UW Youth Programs and the related resources as best practices. Programs and events that are outside of the scope of the Privacy Policy for UW Youth Programs may not disseminate or provide their constituents with access to the Privacy Notice for UW Youth Programs in connection with and as a representation of their own privacy practices. For questions about which principles and practices may be appropriate for your program or event, contact the UW Privacy Office at uwprivacy@uw.edu or (206) 616-1238.

Providing the Privacy Notice for UW Youth Programs

When should my UW Youth Program provide the Privacy Notice for UW Youth Programs?

The Privacy Notice for UW Youth Programs should be provided when UW Youth Programs first collect personal data. Accordingly, a UW Youth Program must evaluate all of its business processes and data processing activities to identify when personal data is first collected or as soon as feasible thereafter.

For many UW Youth Programs, the first point of personal data collection may be in connection with an application or registration form. Accordingly, applications and registration forms should be accompanied by the Privacy Notice for UW Youth Programs either as an additional printed document (if applications or registration forms are distributed in paper format) or through a hyperlink (if applications or registration forms are completed online or transmitted via email).

How can my UW Youth Program keep printed versions of the Privacy Notice for UW Youth Programs distinct and separate from other printed materials that my UW Youth Program may disseminate?

Consider keeping the Privacy Notice for UW Youth Programs distinct and separate from other materials by printing and stapling the Privacy Notice for UW Youth Programs as a single document and using colored paper.

What should my UW Youth Program do before processing personal data for a new or secondary purpose not described in the Privacy Notice for UW Youth Programs?

UW Youth Programs must limit personal data process to the original purpose and activities described in the Privacy Notice for UW Youth Programs. New or secondary data processing activities that are unrelated to and/or inconsistent with the original purpose for data processing may require supplemental notice and consent. Before processing any personal data for a new or secondary purpose, please consult with the UW Privacy Office at uwprivacy@uw.edu or (206) 616-1238.

The Privacy Notice for UW Youth Programs describes a mix of data processing activities in which my UW Youth Program does and does not engage. Should my UW Youth Program still disseminate the Privacy Notice for UW Youth Programs?

Yes, your UW Youth Program should still disseminate the Privacy Notice for UW Youth Programs. The Privacy Notice for UW Youth Programs describes practices across all in-scope UW Youth Programs at the UW rather than unique practices in individual UW Youth Programs. Notably, the Privacy Notice for UW Youth Programs informs parents, guardians, and consenting participants that “Depending on the nature of a UW Youth Program, some or all of the personal data described [therein] may be collected and used…”

Accordingly, UW Youth Programs are neither required nor encouraged to engage in all data processing activities described in the Privacy Notice for UW Youth Programs. Rather, UW Youth Programs are prohibited from engaging in any data processing activities that are not already included in the Privacy Notice for UW Youth Programs. If your UW Youth Program seeks to engage in an activity not already described in the Privacy Notice for UW Youth Programs, please read the preceding Frequently Asked Question (“What should my UW Youth Program do before processing personal data for a new or secondary purpose not described in the Privacy Notice for UW Youth Programs?”).

Soliciting Consent for Certain Data Processing Activities

Which data processing activities require prior consent?

As detailed in the Privacy Notice for UW Youth Programs, prior consent is required before engaging in any of the following data processing activities:

  • Sending communications relating to announcements, assignments, logistics, mentoring, or similar matters to participants who are under 13 years of age during a UW Youth Program;
  • Sending communications about other UW Youth Programs that may be of interest to participants;
  • Sharing personal data within UW for prospective student recruiting;
  • Sharing personal data with a third-party (ex. funding partner) for reporting that is optional for a UW Youth Program;
  • Publishing photos, videos, audio recordings, or content created by participants in promotional materials of a UW Youth Program and/or the UW such as brochures, online content, etc.; or
  • Featuring photos, videos, audio recordings, or content created by participants on a UW Youth Program bulletin board, blog, newsletter, or through a similar publicly-accessible medium.

What is affirmative consent and how does my UW Youth Program obtain it?

Affirmative consent is permission for a proposed activity that is given by an individual actively, voluntarily, clearly, and with sufficient knowledge about the data processing.

The Privacy Consent Form Template for UW Youth Programs is a mechanism for UW Youth Programs to obtain affirmative consent for certain practices that warrant additional reflection (ex. communications with minors under the age of 13 via email or text message, etc.).

As a contrast to affirmative consent, inactive, passive, or inferred consent does not involve meaningful action by an individual. For example, a disclaimer that states “by participating in this program or event, you consent to personal data processing” is not affirmative consent. Similarly, a pre-checked box in an online consent form does not constitute affirmative consent as it does not reflect deliberate individual action. Consent should not be relied upon unless it is affirmative.

What is an example of just-in-time consent?

Just-in-time consent is solicited just before personal data is processed for an activity that requires consent.

For example, a UW Youth Program may provide the Privacy Notice for UW Youth Programs in March when it begins its summer day camp registration (i.e., the first point of personal data collection). In July, the UW Youth Program receives a reporting request from its funding partner to voluntarily submit identifiable demographic information for funding-related analysis. Since the UW Youth Program did not obtain consent in March during its registration period, it would need to obtain consent in July through use of a consent form just before sharing identifiable demographic information with its funding partner. 

How can my UW Youth Program keep printed versions of its finalized consent form distinct and separate from other printed materials that my UW Youth Program may disseminate?

Consider keeping your UW Youth Program’s finalized consent form distinct and separate from other materials by printing and stapling the finalized consent form as a single document and using colored paper.

How can my UW Youth Program honor individual consent (or the absence of consent)?

UW Youth Programs must evaluate the entirety of their operations and business processes to identify any data processing that would involve consent obtained from individuals. A UW Youth Program’s operations and business processes need to be designed with mechanisms that allow for individual choices to be honored.

For example, if a UW Youth Program sends participants under the age of 13 emails about assignments or event logistics, it should only include those participants for whom consent has been obtained in its email distribution lists. As an alternative to emailing a participant under the age of 13, UW Youth Programs may email the participant’s parent or guardian or, alternatively, make assignments or event logistics visible online or available in paper form.

How can my UW Youth Program accommodate participants for whom no required consent has been obtained in connection with photography or recordings?

UW Youth Programs should consider dedicated environments where participants can engage in program or event activities without being exposed to photography or recordings that require prior consent.

For example, in a computer lab space with a mix of participants for whom consent has and has not been obtained for promotional photography or recordings, consider reserving a limited number of computer stations as photography-friendly spaces while directing participants for whom consent has not been obtained to the remaining computer stations that are designated as being free of photography.  To the extent it is age appropriate, consider utilizing signs or posted notices to visually distinguish photography-friendly spaces from photography-free spaces.

Glossary of Privacy Terms

See the UW Privacy Office’s Glossary of Privacy Terms for definitions of terms that appear in the Privacy Policy for UW Youth Programs, related resources, and this webpage.