Privacy Principles at Cornell

Privacy is essential to the mission of a university. It supports academic freedom, fosters trust, and the ethical and lawful handling of personal data. The Privacy Principles are not rigid rules; they are guiding values that encourage thoughtful, ethical decision-making when working with personal data across the university. They are intended to be aspirational and adaptable, promoting a culture of respect, responsibility, and care in handling personal data, whether in research, teaching, administration or everyday operations.

These Privacy Principles are intended to guide decision-making involving personal data across the university. While their application may vary depending on the circumstances, and some principles may carry greater weight where legal or regulatory requirements apply, they provide a shared framework for thoughtfully addressing privacy considerations. The principles do not create contractual or legal rights or obligations, nor are they intended to replace existing policies. Instead, they offer a common language for promoting responsible data practices that support the university's mission, respect individual privacy expectations, and help reduce privacy-related risks for both individuals and the institution.

Lawfulness, Fairness, and Transparency - Handle personal information in ways that are compliant with the law, considerate of individual expectations, and communicated clearly to those affected.

Accountability and Stewardship - Promote clear responsibility, appropriate oversight, and continuous improvement in the management of personal data.

Storage Limitation - Retain personal data only for as long as it serves a legitimate purpose and dispose of it appropriately when no longer needed.

Purpose Limitation - Use personal data in ways that are consistent with the purposes for which it was collected and in support of legitimate university needs.

Data Minimization - Limit the collection, use, sharing, and retention of personal information to what is reasonably needed for the intended purpose.

Accuracy - Maintain personal data that is reliable, complete, and appropriately current for its intended use.

Individual Choice and Control - Strive to support opportunities for individuals to make informed choices and exercise applicable rights regarding their personal data.

Security - Protect personal data through appropriate safeguards that help preserve its confidentiality, integrity, and availability.