UIN Reclassification


Policy

On September 1, 2009 the definition of "directory information" for the University of Illinois, in accordance with the Family Educational Rights and Privacy Act (FERPA), will be expanded to include University Identification Numbers (UINs). As such, the UIN may be disclosed without the express written consent of the student (unless the student has elected to suppress the release of his/her directory information). The publication or release of directory information is discretionary. Please contact the appropriate Records office at your campus if you have any questions.

This change in no way affects the current policies in place with regard to Social Security Numbers (SSNs), which are highly confidential and legally protected. Please see the University's Social Security Number Policy for more information.

i-card Programs creates, owns, and is the authoritative source for UINs. We want to remind all units of the policy forbidding use of the UIN for authentication (that is, as a password/means to access private information). The ban went into effect in 2006, when UIN authentication was retired and i-card Programs started denying incoming requests to use the UIN for authentication. Adherence to the ban is particularly important under the FERPA reclassification.

History

The University created UINs to replace SSNs as the unique identification element in University systems. Each person at the University has a UIN, and this number never changes. The UIN was originally intended to be used like a name—a name that is unique across the entire University of Illinois enterprise.

In 2002, i-card Programs received word from the Department of Education (DOE) that student identifiers (including UINs) are by default considered private information as part of the educational record. The educational record comprises those confidential files, documents, and other information related directly to a student and that are maintained by the University or by a person acting for the University. Narrow exemptions to that classification were available under the classification of directory information, and so in cooperation with campus registrars, the Chicago FERPA committee, and other appropriate individuals, i-card Programs (a unit of OBFS) has been working to reclassify UINs as directory information. The effort was motivated by our desire to have the UIN function as originally intended (as a unique identifier) and not have to be handled with the same level of caution as SSNs.

In 2008, the DOE proposed closing the narrow exemptions that would allow classification as directory information. Schools across the country responded vigorously, pointing out the data security burdens presented by treatment of student identifiers as part of the confidential portion of the educational record. As a result, in December 2008, the DOE clarified that student identifiers are allowed to be designated as directory information, provided that they are not used as passwords or for authentication to obtain information in the confidential portion of the educational record.

Action Items

After September 1, 2009, UINs will be categorized as directory information. Units should be prudent in their distribution of UIN data, bearing in mind that students will retain the option to suppress their UINs from public display, just as they can suppress their home addresses and other directory information.

Units currently out of compliance with the ban on using UINs for passwords or authentication will be required to come into compliance before September 1, 2009. Units who are using UINs for passwords or authentication and need help or have questions can contact their campus registrar.

If your unit has a website or documents that define directory information, please update your materials to reflect this change as of September 1, 2009.

If you have any questions about this correspondence, please contact i-card Programs at (217) 265-6464 or email icardhelp@uillinois.edu.

Information for Students

UINs are used to manage University-related activities, including registering for classes, paying tuition, borrowing library materials, and ordering transcripts. Each UIN is unique and permanent across the entire University enterprise; it never changes and is never reused.

As directory information, a UIN may be disclosed by the University for any purpose, at its discretion. For currently enrolled students, "directory information" also includes, but is not limited to, a student's name, addresses, and telephone number.

Students have the right to require that directory information about them not be disclosed.

Consult each campus's student records policy for more information.

Help for Faculty and Staff

If you are running a phone verification system that requests UINs and you need help with compliance, contact the appropriate Records office at your campus:


If you have applications that use UINs for authentication/authorization and you need help with compliance, please contact the appropriate technology office:


Additional Resources

For more information on University policies, visit the following Web pages:


For details about directory information, consult the following resources: