Data Security and Privacy
This page provides important information on BC's data classifications. "Confidential" and "Strictly Confidential" data, as defined by the Boston College Data Security Policy, should not be used in any online AI tool (even if it has data protection) without University review. See BC's University Tech Acquisition Page for more information about the University review process (aka "Get Tech").
IMPORTANT
The charts below provide guidance on what types of data are permitted to be entered into BC-approved generative AI tools—tools that are tied to your BC email address and either (1) BC has purchased licenses for (Copilot, Gemini, and Gemini Notebook) or (2) have been approved after undergoing review.
Do not use your BC credentials (BC username, password, or any BC email address) to sign up for non-BC-approved generative AI tools. When you use your BC email address to sign up for online services, even if they are free, you may be putting your personal information and BC data at risk.
BC Data Classifications and Examples
Below are definitions and examples for the four categories of data outlined in the Boston College Data Security Policy. Please note that exampels are illustrative, not exhaustive.
BC's Definition
Information BC has a contractual, legal, or regulatory obligation to safeguard in the most stringent manner. Unauthorized access could cause significant invasion of privacy or expose the University community to significant financial risk.
Examples
Massachusetts PI (name combined with SSN, driver's license/state ID number, or financial account/card number); GLBA "customer information"; health, medical, or psychiatric information; HIPAA-protected data; human-subjects research data; export-controlled information; unencrypted passwords.
BC's Definition
Sensitive personal or institutional information. Unauthorized access to personal Confidential information may adversely affect individuals; unauthorized access to institutional Confidential information may directly and negatively affect BC's finances, operations, or reputation.
Examples
Personal: FERPA-protected student records (grades, schedule, test scores, advising records, disciplinary actions); employee pay and benefits; performance appraisals; donor addresses and gift data.
Institutional: University financial and planning information; legally privileged information; invention disclosures and pending patent applications; regulatory reporting; online course evaluations.
BC's Definition
Less sensitive than Confidential or Strictly Confidential, but exposure to unauthorized parties could have an indirect or possible adverse impact on personal interests or on BC's finances, operations, or reputation.
Examples
Internal memos meant for limited circulation; draft documents still subject to internal comment prior to public release.
BC's Definition
Information already generally available to the public, or that would have no material adverse effect on individuals or on BC if it became available to the public.
Examples
Course catalogs, published faculty bios, press releases, public-facing web content.
Regulated Data Chart
What categories of data may be used with the different tools licenced by or approved by BC?
STRICTLY CONFIDENTIAL
NOT ALLOWED
CONFIDENTIAL
NOT ALLOWED
INTERNAL
ALLOWED
PUBLIC
ALLOWED
Microsoft CoPilot, Google Gemini and Gemini Notebook are BC-licensed and include data protection.
STRICTLY CONFIDENTIAL
NOT ALLOWED
CONFIDENTIAL
NOT ALLOWED
INTERNAL
NOT ALLOWED
PUBLIC
ALLOWED
STRICTLY CONFIDENTIAL
NOT ALLOWED
CONFIDENTIAL
NOT ALLOWED
INTERNAL
SELECT USE CASES
PUBLIC
SELECT USE CASES
Paid ChatGPT and Claude subscriptions have received Get Tech approval for select use cases. Faculty and staff interested in obtaining ChatGPT or Claude should contact Administrative and Technology Resources for guidance.