Harvard strives to be a trustworthy steward of personal information. Our Privacy Principles establish a Harvard-wide framework for considering and applying a privacy-protective mindset to the work that we do at the University. 

The strategy behind these Principles is threefold: 1) promote a culture that values privacy, 2) create a foundation for operationalizing privacy at Harvard, and 3) satisfy existing and anticipated regulatory compliance obligations. 

The collection, use, and disclosure of personal information are unavoidable in and essential to Harvard’s operations and its teaching and research mission. At the same time while doing this critical work, we need to consider privacy protections. That’s where these Principles come into play. The Privacy Principles aren’t hard and fast rules but rather aspirational values that we should apply when handling personal information during the course of our work activities. 

This Companion Guide is intended to provide additional context and specificity to assist us in the application of the Principles. Privacy concerns should always be weighed against other University requirements and goals. 

Finally, neither the Privacy Principles, nor this Companion Guide, create any contractual or other legal obligation on Harvard’s part, or any contractual or other legal right or expectation in or for any individual person. 

We recognize that not all of the Privacy Principles can be achieved in all situations. For example, we regularly use and share personal information in connection with our work at the University, often informally and in non-systematic ways. A teaching fellow may communicate information about a student to a faculty member, or administrators may exchange emails about an employee. By contrast, an information system used for administration at the University may generate, store, and make accessible a large data set containing information about a large number of persons—and indeed academic researchers at Harvard may obtain access to large data sets of personal information. While the Privacy Principles can inform the use of personal information at both small (one-off communication) and large (system-generated data sets) scales, the Principles will be applied differently, depending on the form and context of the information at issue. 

 While these Principles are tailored specifically to Harvard’s needs (now and future) and to anticipated regulatory developments, they are based on the internationally recognized Fair Information Practice Principles (FIPPs) that were developed in the 1970s and provide the core values underlying many federal, state and international privacy laws. 

Personal information is any data that relates to an identifiable individual person, including their character traits, history, and activities. Personal information not only includes name, address, and other direct identifiers, but also indirect information such as purchasing history, Internet activity, and, in some cases, information about personal activities, such as resource consumption. 

Owing to the ever-expanding availability of large data sets of personal information and activity logs, it has become possible to re-identify individuals from seemingly anonymized data sets. A data set may on its own be fully anonymized, in that it contains no personal identifiers, but when paired with outside information, including publicly available data, it may well be possible to identify individual subjects in the original set. Accordingly, if a piece of information could tell you something about a person, even if you need (but do not yet have) additional information to “unlock” who it is, it may be appropriate to treat it as personal information. 

Do the Principles apply to all forms of personal information (or just electronic)? The Privacy Principles apply to all forms of personal information collected, stored, and processed by Harvard, including in paper or electronic form. 

Do the Principles apply to all types of personal information? Yes, but of course some categories of information are necessarily more sensitive than others. For example, application of the Privacy Principles will be more important in cases involving health information, financial information, information that could be misused (such as for identity theft or surveillance), and other information that is generally accepted as or obviously private to or about an individual. 

How do the Principles relate to existing Harvard policies? The Privacy Principles are not policy but instead a set of principles to consider and apply in appropriate circumstances weighing privacy against other institutional goals. 

The Privacy Principles do reflect and are consistent with the conceptual underpinnings of several existing Harvard policies, including: 

• Policy on Access to Electronic Information 
• Policy on Installation and Use of Video Cameras 
• IT Professional Code of Conduct to Protect Electronic Information 

Each of us should be mindful about how we manage and use personal information that is entrusted to us and in the systems we use and create. These Principles can inform and guide our decisions and actions as trustworthy stewards, providing a touchstone for bringing privacy to life across the breadth and depth of Harvard’s activities. 

The overarching goal is to infuse privacy considerations into all that we do at Harvard. The Principles are therefore intentionally general and succinct. When you are considering the collection, use, or disclosure of personal information, we ask that you think about the Principles in their totality, considering their purpose and spirit, and then apply your best judgment. If you are uncertain or have questions, contact the Information Security and Data Privacy (ISDP) team for advice. 

• If you are establishing new business operations, research activities, technologies, or other processes involving personal information, consider whether you can incorporate the relevant principles into your system design. When we consider privacy from the earliest stages and throughout the data life cycle (i.e., collection, use, retention, processing, disclosure, and destruction), we are best positioned to implement privacy protections. 
• If you aim to introduce privacy protections to existing business operations, research activities, technologies or other processes involving personal information, review your data practices for alignment with the Principles. Where the practices don’t align with the relevant Principles, and where practical, adjust your practices to bring them into alignment. 
• In all cases, consider the principle of data minimization, as this is highly effective in reducing risks associated with privacy incidents. 

See the full Companion Guide for each of the Privacy Principles to help you understand and, where appropriate, implement them.