Who Should Have Direct Access to your Database?

I'm with Karen...don't ask your alumni, that's opening a can of worms.


You said that all of the requests for data are internal.  That would mean (to me) that even if you have a statement like "we do not sell, trade, or share your information" on anything, so long as the data remains within your org/school, you should be okay (we have this statement on reply cards with appeals as well as various other pieces of collateral).


To me, it seems like this would be more of a case-by-case decision.  For access to RE, I would be sure that those folks have signed an appropriate confidentiality statement, or even an additional one that specifies what they can and cannot do with the data and what they need to talk with you/your department about (i.e. if they want to send out a mailing or something).  And I would ask them to do some training/orientation with you.  For others, like if they are just wanting to analyze some data, it might be easier for them if you just dump the appropriate data and send it, rather than give them access to your database.


It sounds like you need to sit down with your department/leadership and talk this through.

 

Cammi Derr:

Our leadership has been agreeing to provide direct access to our database without understanding the possible security and confidentiality implications this could bring.  I sometimes think the person asking for the access for the purposes of "data mining for prospective donors" understands that the people they are talking to do not fully understand the technology and may be taking advantage of their lack of knowledge.


I can say that the requests for access has been from within our university like the Institutional Effectiveness office and Athletics, however, I don't believe that the requestors understand our data and have not been working with our database ever.  My opinion is just to dump the data they would like to perform analysis without specific names or contact information and provide that to them.


My other opinion is that we should contact all the alums in our database and ask them if they are agreeable to the sharing of specific data from their records.


Does anyone else have any opinions and comments they can make on this topic?

#1  You are the gatekeeper, it is your job, and that of your director to protect the confidentiality of your consitituents.  You can do one of two things.  First instinct is no, unless, you are in the Development/Advancement department you cannot have access to RE for these reasons: Confidientiality, You are not trained to use the software, We only have a certain number of user licenses and adding more is costly, and keeping it the same and adding more users would mean that the department, Development, that owns/uses the data hourly could and/or would get locked out.   The flip side, you could give someone access but limit what they can see and pull with the Security options, including View Only, no editing or adding!, it would be a pain.  The best thing is for them to fill out a request form (this should help you having to pull the data more than once because they forgot something, or don't know what they want/to ask for) and you should export it into a spreadsheet that they can do whatever they like with it.


#2 do not contact Alums about this.  This in in-house analysis.


#3  If another department besides Development/Advancement is data mining for prospects in regards to fundraising, the requests should come to your department.  Conflicts of interest/timing can be an issue if someone else on campus is fundraising -- they can undermine a relationship your department has been cultivating over time in order to make an ask.  Your department has to keep an eye on the greater good/big picture, others making these requests are usually only focused on their own projects and not the impact overall.  Another aspect of gatekeeping that falls on your director.