A holistic model for institutional data privacy protection for higher education institutions in Hong Kong

With the increasing use of artificial intelligence, cloud computing, social media, online classes, work from home arrangements etc., it is of utmost importance that higher education institutions practise vigilance in handling data. Data may include anything from personnel information, academic papers to student records, which, if not handled properly, may lead to data breach incidents. This literature review examines the landscape of data privacy in higher education, focusing on the challenges faced by institutions and regulatory frameworks which govern data privacy protection. The key themes of this review include compliance with local and international regulations, such as the Personal Data (Privacy) Ordinance (PDPO) and General Data Protection Regulation (GDPR).

Further, based on the six data protection principles stipulated by the Office of the Privacy Commissioner for Personal Data (PCPD), a holistic model is proposed for higher education institutes to transform the quality in data protection. First and foremost, institutions should classify data according to criteria such as confidentiality and sensitivity of data. Once data has been classified, different protection strategies could be deployed. For example, there should be regular reviews on existing systems and new systems regarding data privacy. Secondly, educate the educators on the importance and ways to protect institutional data to prevent data breaches. Thirdly, data retention period should be established and followed through strictly. Last but not the least, a data privacy officer should be appointed to oversee the execution of various measures and be the focal point for any data privacy violation incidents.