FAMILY PRIVACY PROTECTION ACT POLICY

(Enacted Pursuant to S.C. Code Section 30-2-10 et. seq.)*

The University is a complex agency which has a variety of legitimate public purposes encompassing teaching, research and extension. It is in the University’s best interest to promote and support affiliated foundations and entities. In some cases the University’s interests can be served by providing goods and services to its students, parents, alumni and employees. The University provides much of this support and many services internally; however there are a number of supportive functions which for various reasons are performed by affiliated entities or private contractors.

To this end, the university will implement the Family Privacy Protection Act (FPPA) as follows:

1. Responsibility. It shall be the responsibility of the Office of Institutional Research to implement compliance with the FPPA, and specifically Section 30-2-40 A.
2. Evaluation. The university will engage in an ongoing evaluation to ensure that the personal information it gathers in its various programs is necessary for the performance of the university’s legitimate public purposes.
3. Personal Rights. The university will continue to inform all persons from whom the university collects personal information (hereinafter, ‘affected persons’) of their rights under applicable laws, including the South Carolina Personal Privacy Protection Act (SC Code Section 30-2-10 et. seq.) and the Family Educational and Right to Privacy Act (20 USC 1232g), as appropriate.
4. Campus Directory Information. The university has determined that publication of its annual campus telephone directory is a business necessity. The university will release this directory to third parties only after notifying the requestor that the information therein may not be used for commercial solicitation and receiving written acknowledgement that the material will not be used for commercial solicitation. The telephone directory and any Web directories containing personal information will contain the warnings referred to in Section 30-2-50 of the FPPA.
5. Foundations and Affiliated Entities. The university will release necessary personal information concerning affected persons to an affiliated entity, that is, an institute, association, foundation, etc, in direct support of the university, provided:
   1. The use for which the material is requested is for a legitimate public purpose in support of the University’s public mission;
   2. The entity acknowledges that the material is to be used only for the purpose or purposes specified;
   3. The entity acknowledges that the material will not be released to a third party without the university’s written consent;
   4. Any contractors of the entity must acknowledge in writing that the material is to be used only for the contracted purpose, and will not be released to third parties without written permission from the University;
   5. Only so much information is released as is necessary to accomplish the stated purpose for the request.
6. Contractors. The University will release necessary personal information of affected persons to a contractor performing tasks which are essential to the fulfillment of the university’s mission, provided:
   1. The contract was reached after compliance with applicable procurement requirements;
   2. The contract is in support of an essential element of one of the University’s legitimate public purposes;
   3. The contractor acknowledges that the material will only be used to fulfill the contract;
      D. The contractor acknowledges that the material will not be disclosed to third parties, without the university’s written consent;
   4. Only so much information is released as is necessary to accomplish the stated purpose of the contract.
7. Third Parties. Subject to the provisions of the S.C. Freedom of Information Act or the Family Educational Right to Privacy Act, personal information which identifies an individual may be released to third parties, provided:
   1. The university first notifies the requestor that: “The information that you have requested is personal information under South Carolina law. It is a violation of South Carolina law to use this personal information for commercial solicitation”;
   2. The requestor provides written acknowledgment that: “I understand that it is a violation of South Carolina criminal law to use the personal information that I have requested for purposes of commercial solicitation”;
   3. Only so much personal information is released as is necessary to accomplish the stated purpose of the request;
   4. Exemptions are contained in Section 30-2-30 (3). A party claiming to be exempt from the application of FPPA will cite the source of the claimed exemption. The requesting party will be advised that the personal information is provided solely for its use under the stated exemption and that any use for commercial solicitation by any other party is illegal under S.C. law.
8. University Use. The university may use any of the personal information it collects from affected persons as necessary to accomplish, or in support of, any of its legitimate public purposes. The university may provide mailing services to or for third parties, provided that the purpose of such services is not commercial solicitation.

Policy last reviewed October 20 2010

*FAMILY PRIVACY PROTECTION ACT OF 2002

SECTION 30-2-10. SHORT TITLE.

This chapter shall be designated as the “Family Privacy Protection Act of 2002.”

•    HISTORY: 2002 ACT NO.225, SECTION 1.

SECTION 30-2-20.

All state agencies, boards, commissions, institutions, departments, and other state entities, by whatever name known, must develop privacy policies and procedures to ensure that the collection of personal information pertaining to citizens of the State is limited to such personal information required by any such agency, board, commission, institution, department or other state entity and necessary to fulfill a legitimate public purpose.

•    HISTORY: 2002 ACT NO.225, SECTION 1.

SECTION 30-2-30.

For purposes of this act, the following terms have the following meanings:

1. “Personal information” means information that identifies or describes an individual including, but not limited to, an individual”s photograph or digitized image, Social Security number, date of birth, driver”s identification number, name, home address, home telephone number, medical or disability information, education level, financial status, bank account numbers, account or identification number issued, used, or both by any federal or state governmental agency or private financial institution, employment history, height, weight, race, other physical details, signature, biometric identifiers, and any credit records or reports. “Personal information” does not mean information about boating accidents, vehicular accidents, driving violations, boating violations or driver status, or names and addresses from any registration documents filed with the Department of Revenue as a business address which also may be a personal address.
2. “Legitimate public purpose” means a purpose or use which falls clearly within the statutory charge or mandates of an agency, board, commission, institution, department, or other state entity.
3. “Commercial solicitation” means contact by telephone, mail, or electronic mail for the purpose of selling or marketing a consumer product or service. “Commercial solicitation” does not include contact by whatever means for the purpose of:
   1. offering membership in a credit union;
   2. notification of continuing education opportunities;
   3. selling or marketing banking, insurance, securities, or commodities services provided by an institution or entity defined in or required to comply with the Federal Gramm-Leach-Bliley Financial Modernization Act, 113 Stat. 1338;
   4. contacting persons for political purposes using information on file with state or local voter registration offices.
4. “Medical information” includes, but is not limited to, blood samples and test results obtained and kept by the Department of Health and Environmental Control pursuant to Section 44-37-30.

•    HISTORY: 2002 ACT NO.225, SECTION 1; 2003 ACT NO. 20, SECTION 1; 2003 ACT NO. 69, SECTION 3.11.

SECTION 30-2-40.

1. Any state agency, board, commission, institution, department, or other state entity which hosts, supports, or provides a link to page or site accessible through the World Wide Web must clearly display its privacy policy and the name and telephone number of the agency, board, commission, institution, department, or other state entity person responsible for administration of the policy.
2. Where personal information is authorized to be collected by an entity covered by this section, the entity must at the time of collection advise the citizen to whom the information pertains that the information is subject to public scrutiny or release.
3. Subsection (B) does not apply to criminal justice or judicial agencies, or both.

•    HISTORY: 2002 ACT NO.225, SECTION 1.

SECTION 30-2-50.

1. A person or private entity shall not knowingly obtain or use any personal information obtained from a state agency for commercial solicitation directed to any person in this State.
2. Each state agency shall provide a notice to all requestors of records pursuant to this chapter and to all persons who obtain records pursuant to this chapter that obtaining or using public records for commercial solicitation directed to any person in this State is prohibited.
3. All state agencies shall take reasonable measures to ensure that no person or private entity obtains or distributes personal information obtained from a public record for commercial solicitation.
4. A person knowingly violating the provisions of subsection (A) is guilty of a misdemeanor and, upon conviction, must be fined an amount not to exceed five hundred dollars or imprisoned for a term not to exceed one year, or both.
5. This chapter does not apply to a local governmental entity of a subdivision of this state or local government.

•    HISTORY: 2002 ACT NO.225, SECTION 1; 2003 ACT NO. 20, SECTION 2.