KU News Release

KU announces findings of investigation into inappropriate disposal of documents

LAWRENCE — The University of Kansas has completed its investigation into the inappropriate disposal of documents containing personal information from the Department of Mathematics and has been contacting affected parties by phone or mail, officials said today.

The investigation was launched in response to the Sept. 18 receipt by three area newspapers of packets of documents, some of which contained personally identifiable information such as a Social Security number and/or student ID number, that were taken from university trash or recycling bins.

To prevent similar instances in the future, the math department has contracted with a shredding company to destroy discarded documents, and 14 secure bins have been placed around the department’s office for the purpose of collecting materials to be destroyed.

Additionally, math department faculty and staff have received information on document protection and disposal policies, and the department has changed the settings on its fax machine so that confirmation sheets no longer display an image of the document being sent.

“Small, seemingly insignificant things can lead to serious breaches of security,” said Jane Rosenthal, KU’s privacy officer. “That’s why it’s so important for everyone who handles private information to know the proper way to secure and, if necessary, destroy that information.”

Enhanced security for private data is the goal of the information management initiative announced by Provost Richard Lariviere at the Sept. 6 faculty-staff convocation. When implemented, that initiative will create a more comprehensive approach to the management and protection of personal data at KU.

Lariviere is asking units to provide updates on the steps they have taken regarding the privacy and security of sensitive and/or confidential information. Additionally, representatives of the Privacy Office will be making unscheduled visits to offices throughout campus to observe firsthand how staff is handling and disposing of information.

KU’s investigation revealed that the largest group of documents contained in the packets were fax confirmation sheets featuring a partial image of the document being sent. There were also some class rosters, exams, grade forms and other miscellaneous documents in the packets. Some documents appeared to be personal in nature and unrelated to university business, and are thought to have been discarded by the individuals whose information appeared on them.

“This incident uncovered deficiencies in how this particular department handled private information, but it also provided the entire KU community with a valuable lesson in why we need to focus on keeping personal information secure. Ensuring the privacy of data is something that has to take place every day, and it has to involve every member of the university community,” said Rosenthal.

The university has taken steps to notify individuals whose sensitive personally identifiable information was contained on the documents. Notification letters were sent last week to the majority of individuals, though in some cases affected individuals received phone calls.

In both instances, affected students, faculty and staff were told what kind of personal information the documents contained and given guidance on resources they can use to prevent the misuse of that information.

“We want to let these individuals know what sort of information was involved so they can take whatever steps they feel are appropriate to protect themselves,” said Rosenthal.

Upon notification of the receipt of these documents by area newspapers, the university immediately requested the return of the documents. The University Daily Kansan provided the university with the original documents and kept copies. The Lawrence Journal-World refused to return the original documents but did provide the university with copies. There were approximately 230 pages of documents provided to the university, many of which contained duplicate information. Representatives from both newspapers report they have shredded the documents in their possession.

The documents sent to the Kansas City Star were destroyed by the newspaper before university officials were able to examine them.

-30-

The University of Kansas is a major comprehensive research and teaching university. University Relations is the central public relations office for KU's Lawrence campus.