Purpose

To minimize potential data exposure and security risk by providing guidelines for the disposal of Electronic Devices and media, once they are deemed Surplus Assets. Sale, re-allocation within the University, or transfer to a pubic body of these Surplus Assets can involve risks related to unauthorized release of confidential information, unauthorized disclosure of trade secrets, copyrights, or other intellectual property, unauthorized access to personal information protected under privacy legislation that might be stored on the hard disks and other storage media, or potential violation of software license agreements. 

Scope

All University-owned Electronic Devices and media used by faculty, staff, students and others affiliated with Memorial University of Newfoundland.

Definitions

Asset Administrator — This role is normally carried out by the employee in the Unit who has responsibility for financial matters. This role is responsible for ensuring measures are in place within the Unit for safeguarding Tangible Assets, for reviewing, maintaining and updating the Unit's Tangible Capital Asset property report and corresponding with FAS to ensure necessary updates are made to Tangible Capital Asset records. This is a functional description, not a position title.

CTS — Campus Technology Services. The various technology service providers for Memorial University campuses (Marine Institute Information and Communications Technologies (ICT), Grenfell campus Information Technology Services (ITS), Harlow campus systems, St. John's campus Office of the Chief Information Officer (OCIO)).

Electronic Device — Any device that is powered and is used to access, process or store University data including any information technology storage media run by, or attaching to, a device. This may include but is not limited to computers, multifunction printers with storage, hard disks, memory keys, SD cards, mobile/cellular devices, DVD/CDs, peripherals and software.

IT-Classified Staff — Employed by the various technology service providers for Memorial University campuses (Marine Institute Information and Communications Technologies (ICT), Grenfell campus IT Services (ITS), Harlow campus systems, St. John's campus Office of the Chief Information Officer (OCIO), Labrador Institute (OCIO), Gander and Grand Falls Nursing Satellite Sites (OCIO)) and Select Units with Director/Head and Human Resources approval to provide local IT Support).

Surplus Asset — A Tangible Asset that has reached its optimal benefit for reasons such as wear, obsolescence, or changes in technology, teaching methods or Unit requirements.

Tangible Asset — Anything owned by the University that has a monetary value and includes Items such as buildings, property, furniture, equipment, computers, electronic devices, machinery, instruments.

Tangible Capital Asset — Those Tangible Assets which are of a continuing or long-term use in the conduct of the University's operations and which must be recorded in the University's financial records as capital to meet financial reporting requirements and for insurance purposes. See Schedule of Tangible Capital Asset Determinations.

Unit Head — For the purposes of this policy, unit head is the term used to mean Deans, Department Heads, Division Heads, Heads of Schools, Directors, Executive Directors, University Librarian, University Registrar and other senior administrators at a comparable level; Associate Vice-Presidents and Vice-Presidents, as applicable.

Policy

All university employees are responsible for the use and care of the Electronic Devices and media assigned for their use. When these are no longer of use to the assigned employee and cannot be repurposed, they may be deemed Surplus Assets in accordance with the Tangible Asset Administration policy. Employees must take all reasonable steps to limit Memorial University's liability and risk with regards to the protection of the data and software on Electronic Devices and media.

In accordance with the related procedures and regardless of the surplus option chosen, Electronic Devices must have the data and any licensed software removed or the device destroyed. 

Unit Heads are responsible to ensure compliance with this policy and its related procedures. The Asset Administrator is responsible for executing the related procedures. The IT-Classified staff is responsible for destruction of the data, following technical guidelines outlined in the related procedures.

IT Classified Staff can identify systems that do not meet Memorial’s requirements and initiate the disposal process after a suitable amount of time has been provided to identify whether the data would be transferred to another system.

Requests for deviation from this policy are to be addressed to the CIO, through the Vice-President (Administration, Finance and Advancement). Requests should detail the section of the policy for which the exemption is being sought, and propose compensating controls if any. Requests for exemption must be endorsed by the Unit Head.

Related Documents

Enterprise Risk Management policy
Information Management policy
Tangible Asset Administration policy 

Procedures: