Skip to main content
Please enter a legal issue and/or a location
Begin typing to search, use arrow keys to navigate, use enter to select

Find a Lawyer

More Options

It is Time To Address Data Breaches In Colleges And Universities

By Minara El-Rahman on March 30, 2010 | Last updated on March 21, 2019

FindLaw columnist Eric Sinrod writes regularly in this section on legal developments surrounding technology and the internet.

If you feel like you have been hearing quite a bit about data breaches in colleges and universities, there is a reason.  Institutions from the educational sector reported more breaches than any other sector for the recent period of September 2008 to March 2009, according to the Privacy Rights Clearinghouse. Indeed, colleges and universities reported four times the number of breaches than the institutions within the health care sector; the sector that reported the second most data security breaches. 

It certainly is laudable that educational institutions seem to take their data security breach notification responsibilities seriously, but it is imperative that they learn to avoid so many breaches in the first place. This is especially true given that colleges and universities collect personal and highly sensitive data not only from students, but also from faculty, personnel, applicants, alumni, business partners and others. This information often includes private financial, health, academic, demographic and other details.

Many of the data security incidents of educational institutions result from the loss or theft of equipment and errors leading to unauthorized access. Steps can and should be taken to safeguard equipment and access. 

For those colleges that have not done so already, they really ought to have a Chief Privacy/Security Officer in place who provides overall guidance and direction. An analysis of how and where an educational institution collects, maintains, and distributes private information should be conducted. A privacy and security policy should be developed and followed by the institution.

In going about this process, colleges and universities should consult with legal counsel who are knowledgeable and skilled in this area. This is true for many reasons including the fact that many federal and state laws come into play in terms data requirements. These laws include state breach notice laws, the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, data security laws requiring encryption under certain circumstances, and other laws.

Hopefully as time goes on and as educational institutions get it right, we will hear less and less about data security breaches in this important sector.

Related Resources:

Eric Sinrod is a partner in the San Francisco office of Duane Morris LLP ( where he focuses on litigation matters of various types, including information technology and intellectual property disputes.  His Web site is and he can be reached at  To receive a weekly email link to Mr. Sinrod's columns, please send an email to him with Subscribe in the Subject line. This column is prepared and published for informational purposes only and should not be construed as legal advice.  The views expressed in this column are those of the author and do not necessarily reflect the views of the author's law firm or its individual partners.

You Don’t Have To Solve This on Your Own – Get a Lawyer’s Help

Meeting with a lawyer can help you understand your options and how to best protect your rights. Visit our attorney directory to find a lawyer near you who can help.

Or contact an attorney near you:
Copied to clipboard