UW Privacy Office

Demographic Data

Last updated on January 10, 2024

Appropriate Collection and Use of Demographic Data for Job Applicants and University Personnel

1. Purpose

This policy provides requirements for processing (as defined in Appendix A) demographic data of job applicants and University Personnel as described with Administrative Policy Statement 40.1 Types of University Personnel.

This policy also provides a foundation for processing demographic data to fulfill federally mandated reporting requirements, supporting the UW’s initiatives identified by the President or Provost or approved by the HR Data Domain Council, and protecting the privacy of job applicants and University Personnel. This policy supplements and further interprets the privacy requirements in UW Administrative Policy Statement (APS) 2.2 University Privacy Policy and UW values and principles for privacy.

2. Scope

This policy applies to:

  • Demographic data associated with job applicants and University Personnel; and
  • All areas of the UW, including but not limited to UW Medicine, UW Tacoma, and UW Bothell.

3. UW Responsibilities

UW Data Governance Committees and Privacy Steering Committee

The HR Data Domain Council and the UW Privacy Officer create and maintain University-wide policies and practices for data processing involving demographic data of job applicants and University Personnel. This policy and the related practices are intended to:

  • Uphold UW’s trusted relationship with individuals;
  • Develop a common and cohesive understanding of the data and related reports;
  • Help safeguard individual privacy by addressing privacy and data protection requirements;
  • Improve the quality and accuracy of the data, by establishing and maintaining a universal nomenclature articulated in Appendix A to this document, for mandated reporting and analysis (e.g., state, federal).

UW Executive Heads of Major Organizations

The executive heads of major UW organizations are vice presidents, vice provosts, deans, chancellors, or other individuals with delegated executive authority from the President or Provost. Major UW organizations are those described in Administrative Policy Statement 1.2 or as otherwise agreed upon by the HR Data Domain Council in an appendix to this policy. The executive heads or their delegates of these organizations are responsible for implementing processes, procedures, and delegations of authority to comply with law and UW policies, including, but not limited to UW Administrative Policy Statement 2.2 University Privacy Policy. Specifically related to demographic data of job applicants and University Personnel, UW Executive Heads and/or their delegates must:

  • Complete the required training as specified by the HR data domain council and UW Privacy Officer;
  • Comply with this policy and ensure those who receive the data also comply with this policy;
  • Separate application materials from demographic data and limit sharing of demographic data of faculty and staff applicant pools to their direct reports who:
    • Have a need to know such data or information to perform their job duties; and
    • Are not directly involved in the hiring decisions.
  • Agree to and sign UW’s Internal Data Processing Memorandum of Understanding (MOU) for the release of identifiable data within the UW;
  • Require all individuals who receive pseudonymized and identifiable data, reports, access to, or information about the demographics of job applicants and University Personnel to:
    • Complete the required training as specified by the HR data domain council and UW Privacy Officer;
    • Comply with this policy;
    • Not share or redisclose the data, reports, or information without explicit written permission from the Executive Head of the Major Organization.

4. Definitions

Terms and definitions are defined in the UW Privacy Office Glossary of Privacy Terms and are congruent with or supplement UW policies and/or privacy and data protection related laws and regulations.

Anonymized
Data or information that does not relate to an identified or identifiable natural person or the data subject is not or is no longer identifiable.
De-Identified
Data from which direct and known indirect identifiers have been removed or mathematically manipulated (de-identification) so there is no reasonable basis for believing that data can be linked to a specific individual. De-identification may not be robust against existing or future re-identification methods.
Personal Data
Any records or information relating to an identified or identifiable natural person, such as name, demographic data, identification number, location data, online identifiers, or factor(s) specific to physical, physiological, genetic, mental, economic, cultural, or social identity or characteristics; or is defined as personally identifiable data, personally identifiable information, or a similar term under law or regulation.
Special Categories of Personal Data
Categories of personal data that when alone or combined with other data could result in a greater level of potential harm or are considered sensitive by the University or individuals. Special categories of personal data also may be confidential information protected by law or regulation. Special categories of personal data include, but are not limited to, data or information regarding criminal offenses, citizenship and/or immigration status, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used to identify a natural person, health, disability, protected veteran/military status, sex life, gender, gender identity, sex, or sexual orientation, universal identification numbers, or youth under the age of eighteen (18). (Refer to the complete list on the UW Privacy Office website.)
Processing or Data Processing
Any operation(s) performed on Personal Data, whether or not by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, access, use, disclosure by transmission, dissemination, combination, restriction or destruction.
Pseudonymized
Information from which direct identifiers have been eliminated, transformed, or replaced by pseudonyms or other identifiers, but indirect identifiers remain intact. Pseudonymized data may have or may not have a separate re-identification key. Re-identification may result from failing to secure the pseudonymization method or key used, and/or when reverse engineering is successful.

5. Privacy by Design

The use of demographic data must incorporate privacy by design and the UW values and principles for privacy in each component described in this section.

A. Purpose of Data Processing

Demographic data of job applicants and University Personnel are collected and processed by the Office of Academic Personnel and Human Resources for the UW, which includes HR for UW Medicine, UW Bothell, and UW Tacoma. These data are collected and processed to comply with obligations established by the federal government in our role as a federal contractor, similar obligations mandated by Washington State, and to address initiatives identified by the President or Provost or approved by the HR Data Domain Council.

All UW Units must obtain the HR Data Domain Council and UW Privacy Officer approval prior to engaging in any UW Unit specific data processing of demographic data of job applicants and University Personnel.

All UW Units who engage in personal data processing, including, but not limited to Data Processing involving demographic data, must consult with the UW Privacy Office to provide information on their business processes and supporting systems.

B. Privacy Notice and Consent Forms

All UW Units are responsible for ensuring that the data processing activities in their Unit are consistent with and do not deviate from the privacy practices described in the Privacy Notice for Demographic Data of Job Applicants and University Personnel. The Privacy Notice for Demographic Data of Job Applicants and University Personnel must be provided to the relevant individuals when demographic data are first solicited from them or as soon as feasible thereafter.

If a UW Unit receives approval from the HR Data Domain Council and UW Privacy Officer to process demographic data of job applicants or University Personnel (as described in section 5.A of this policy), the HR Data Domain Council and UW Privacy Officer must determine if the processing requires a revised or supplemental privacy notice or a consent form. Such notices or forms must be approved by the HR Domain Council and the UW Privacy Officer.

C. Training and Educational Materials

Training and educational materials related to the processing of demographic data are essential to help support the UW’s initiatives identified by the President or Provost or approved by the HR Data Domain Council, provide important context about the data, and inform users about appropriate use of such data. Examples of training and educational materials related to demographic data include, but are not limited to the:

D. Data Minimization and Data Quality

If a UW Unit receives approval from the HR Data Domain Council and UW Privacy Officer to solicit and/or process demographic data of job applicants or University Personnel (as described in section 5.A of this policy), the UW Unit must:

  • Limit its data processing to its original purpose; and
  • Use the universal nomenclature articulated in Appendix A.

E. Internal Data Sharing

Sharing identifiable, de-identified, and pseudonymized demographic data requires the recipient(s) of such data to agree to and sign the UW’s Internal Data Processing MOU between the recipient and the HR Data Domain Council. Further sharing of identifiable demographic data is not permitted unless:

  • Approved by the HR Data Domain Council (which is inclusive of the Affirmative Action Officer) and UW Privacy Officer; and
  • The recipient and the HR Data Domain Council have agreed to and signed the UW’s Internal Data Processing MOU as noted.

UW Human Resources and the Office of Academic Personnel in collaboration with the Office of Planning and Budgeting are responsible for providing reports for demographic data. These offices provide demographic data that are appropriately de-identified, pseudonymized, or anonymized for UW initiatives. Reports in aggregate are provided through the staff and faculty dashboards. Disclosure of the data must be consistent with this policy or as required by law.

i. Sharing Identifiable Demographic Data within the UW

Identifiable data includes data that can be used to identify a person directly, indirectly, or by reference. Sharing identifiable data within the UW is limited to:

  • Executive heads of major UW organizations (i.e., vice president, vice provost, dean, chancellor or other individuals who report directly to the President or the Provost of the UW) and their designee as long as the recipients of the identifiable data are not involved in a hiring process, hiring decision, or making recommendations about a hiring decision that is related to the individuals who are identified from the report; or
  • To comply with UW’s policy as determined by the HR Data Domain Council’s or UW’s obligations as required by law.

ii. Sharing De-Identified or Pseudonymized Demographic Data within the UW

Sharing reports with de-identified or pseudonymized demographic data, except as otherwise required by law, is limited to the Board of Regents, president, provost, vice presidents, vice provosts, deans and chancellors and their direct reports who are tasked with developing interventions or monitoring progress towards the UW’s initiatives identified by the President or Provost or approved by the HR Data Domain Council.

To help promote confidentiality of personal demographic data according to applicable law and to decrease the likelihood of individual identification, reports will typically not include details when there are five or fewer individuals associated with the demographic data element. Reports with fewer than 5 individuals (n<5) must:

  • Minimize the combining of de-identified data elements to help ensure that individuals may not be re-identified;
  • Be presented in a manner to reduce and mitigate the risk of improper use in hiring decisions;
  • Be accompanied with training about appropriate use; and
  • Be made pursuant to the UW’s Internal Data Processing MOU between the recipient of the data and the HR Data Domain Council.

The use of de-identified or pseudonymized demographic data must:

  • Be distributed through a central maintained repository (e.g., faculty and staff dashboards) or distribution mechanism by HR Data Domain Council;
  • Be available on a need to know basis (e.g., authorized user(s) of the faculty and staff dashboards); and
  • Not be shared further, except as otherwise permitted on this webpage and by the HR Data Domain Council.

iii. Sharing Anonymized Data

Processing demographic data that are requested to be anonymized, but are not yet anonymized, requires HR Data Domain Council approval. Sharing anonymized data that are already anonymized by Office of Planning and Budgeting, Human Resources, or Office of Academic Personnel (such as the Academic Personnel Reports) does not require HR Data Domain Council approval, an internal data processing MOU, or training.

F. External Data Sharing

A Data Processing Agreement (DPA) must be in place when sharing identifiable, de-identified, or pseudonymized data outside of the UW. A DPA is not required if data are anonymized or when a UW Unit is responding to a data request that is mandated as part of a legal process and in response to official requests by government or regulatory agencies, or in connection with other legal obligations (e.g., a warrant or subpoena).

i. Sharing Identifiable Demographic Data External to the UW

Except as otherwise required by law, sharing identifiable data external to the UW must:

ii. Sharing De-Identified or Pseudonymized Demographic Data Outside of the UW

Except as otherwise required by law, sharing de-identified or pseudonymized, reports and/or report content outside of the UW is limited to:

  • The staff demographic dashboards and reports provided by UW Human Resources, which provides the staff demographic data for all areas of the UW including UW Medicine, UW Bothell, and UW Tacoma;
  • The Academic Personnel dashboard provided by the Office of Planning and Budgeting in collaboration with the Office of Academic Personnel;
  • Other processing activities that have completed the review and approval process described in this policy.

G. Data Request

Requests for processing demographic data must be:

  • Consistent with the guidance provided by the HR Data Domain Council in collaboration with the UW Privacy Officer;
  • Sent to the HR Data Domain Council for review and approval; and
  • Once approved, registered with the UW Privacy Office.

H. Retention of Demographic Data

Demographic data should only be kept:

I. Security of Personal Data

All personal data, including but not limited to demographic data, maintained by the UW must be protected with appropriate technical, physical, and administrative measures as described in UW Administrative Policy Statement 2.6 Information Security Controls and Operational Practices.

6. Additional Information

For additional information relating to the implementation and operationalization of the practices described in this policy contact the HR Data Domain Council at datagov@uw.edu.

For affirmative action-related inquiries, contact the Office of Equal Opportunity & Affirmative Action at eoaa@uw.edu.

For privacy-related inquiries, visit the Privacy Office website or contact the UW Privacy Office at uwprivacy@uw.edu.

Authors: Rachel Gatlin, Erin Guthrie, Shelley Kostrinsky, Ann Nagel
Advisors: UW Division of the Attorney General’s Office
Approved by HR Data Domain Council Chair on November 12, 2021
Endorsed by the Privacy Steering Committee on November 15, 2021
Approved by the University Privacy Officer on November 16, 2021
Approved by Institutional Data Steward for Human Resources Data on January 14, 2022
Approved by the Provost on April 26, 2022
Published February 15, 2022.

This policy will be periodically reviewed by the Privacy Steering Committee. It will remain effective unless modified and re-approved by the Privacy Steering Committee during the review process.

Appendix A: UW Nomenclature for Processing Demographic Data

This appendix articulates the current nomenclature for processing race and ethnicity, data on sex, disability, protected veteran/military status, and gender identity data of job applicants and University Personnel.

1. Race and Ethnicity

  • Hispanic or Latino
  • American Indian or Alaska Native
  • Asian
  • Black or African American
  • Native Hawaiian or Pacific Islander
  • White
  • Choose not to Respond

2. Data on Sex

  • Female
  • Male

3. Gender Identity

  • Female
  • Male
  • X/Non-binary

4. Status as an Individual with a Disability

  • Yes, I have a disability, or have a history/record of having a disability
  • No, I don’t have a disability, or a history/record of having a disability
  • I don’t wish to answer

5. Protected Veteran/Military Status

  • Active wartime or campaign badge Veteran (United States of America)
  • Armed Forces service medal Veteran (United States of America)
  • Disabled Veteran (United States of America)
  • I am a protected Veteran, but I choose not to self-identify the classification to which I belong (United States of America)
  • I am not a protected Veteran (United States of America)
  • I decline to disclose my Veteran status (United States of America)
  • Non-Veteran (United States of America)
  • Recently Separated Veteran (United States of America)

6. Date of Birth

  • The month, day and/or year of birth in any format that could be used to identify a persons’ age, such as MM/DD/YYYY, MM/YYYY, or age ##.