Data Classifications and Privacy

Your Role in Data Privacy and AI at BYU-Idaho

For every BYU-Idaho faculty member, employee, and student, understanding data privacy isn't just a guideline; it's about protecting yourself and our community. This resource is crucial because your responsible handling of information directly safeguards personal details, sensitive research, and the university's operational integrity.

As AI tools become integrated into our work and studies, responsible and ethical use of these tools is critical to protecting data and upholding trust. Your active role in applying these principles is fundamental to promoting a secure and trustworthy digital environment for everyone at BYU-Idaho.

Data Classification for AI Use

Understanding how to classify data is essential for responsible AI use. (Review the BYU-Idaho Data Classification Policy)

Data Classifications

When interacting with AI tools, it’s crucial to understand how your data is handled and which tools are permitted. BYU-Idaho is committed to protecting your privacy and intellectual property.

Data Usage Guide →

Public Data

Data intentionally published for public use on BYU-Idaho websites or the open web and can be accessed without credentials.

Examples

News Maps Events Public Websites Academic Catalogs Academic Deadlines

CHOOSE WISELY; USE WITH ANY TOOL

Internal/Confidential without PII

Data you are authorized to access and use for that same purpose that does not contain PII.

Examples

Budgets Policies Procedures Survey Data Meeting Notes Course Content Authenticated Websites

MUST USE BYUI AUTHORIZED TOOLS

Internal/Confidential with PII*

Data you are authorized to access and use for that same purpose that does contain PII.

Examples

Names Photos Grades Usernames I-Numbers Addresses Contact Info Transcripts Authenticated Websites

MUST USE BYUI AUTHORIZED TOOLS

Restricted Data†

Information of the highest sensitivity where inappropriate loss, change, or disclosure could have grave consequences to the University or its students.

Examples

SSNs Bank Info Passwords Tax Records Legal Files Medical Records Credit Card Info

DO NOT USE WITH ANY AI TOOL

*Please follow the CES Privacy Principles when using any PII. †Using any BYU-Idaho authorized tool with Restricted data is never permitted. For questions about data access and building a custom AI solution, learn more about using AI responsibly.

BYU-Idaho AI Usage & Data Guide

When interacting with AI tools, it's crucial to understand how your data is handled. BYU-Idaho is committed to protecting your privacy and intellectual property. The following guidelines will help you determine the appropriate use of AI tools based on data sensitivity. (See also the CES Privacy Principles)

Always remember:

Don't Feed Private University Data to Unapproved AI Tools: Never input sensitive university information like student IDs, grades, financial data, meeting transcripts, or confidential data into unapproved AI tools (e.g., personal accounts in ChatGPT, Claude, Perplexity, Grok, etc.). These tools learn from what you type, and your private data could become public.
Only Use University-Approved AI Tools: When using AI for work, only use the specific tools and platforms that have been approved by the University. The University has contracts and licenses in place that provide security and privacy to our users. Personally Identifiable Information (PII) should not be used with any AI tools without approval. If in doubt, ask your supervisor or your IT Portfolio Manager before using an AI service for university work.
Verify AI Output, Especially for Facts: AI tools can sometimes "make things up" or provide incorrect information. Always double-check any facts, figures, or critical information generated by AI, especially if it's for official university communications, reports, or academic work. Don't blindly trust AI results.
Be Transparent: When AI meaningfully contributed to your work (follow course or unit guidance on how to disclose).
Understand AI's Limitations and Biases: Recognize that AI reflects the data it was trained on and can sometimes show biases or lack a full understanding of context. Avoid using AI to make critical decisions about individuals (like hiring or grading) without human oversight and judgment.

If you want to use an AI tool or data in ways that are not prescribed on this page, you may submit a formal request to the BYU-Idaho AI Committee.

Recording Meetings & Privacy

Zoom and MS Teams have built-in notifications to others in your meeting when recordings and transcripts are being generated. Tools like Zoom, MS Teams, and ChatGPT (CES) are approved for recording meetings. Zoom and MS Teams automatically notify participants when recordings and transcripts are being created. ChatGPT does not. Therefore, when using any tool to record a meeting, you are legally and ethically responsible for notifying all participants.

Understanding the Risks: AI Scenarios & Consequences

Your everyday choices with AI tools can have significant impacts. Here are a few examples:

Scenario/Action	Possible Consequence(s)
Pasting a student's essay (with their name/ID) into a free online AI grammar checker.	Data Exposure & Privacy Breach: Student's private information becomes part of the AI's data, potentially exposed to others or used for future AI training, violating FERPA.
Using an unapproved AI tool to create study flashcards from your professor's lecture notes.	Intellectual Property Loss & Academic Compromise: The AI tool could use your professor's unreleased lecture notes, which are intellectual property, to train its model or make the content public. This compromises academic integrity by making proprietary course materials accessible to others.
Using an unapproved AI tool to summarize confidential meeting notes containing employee salaries or strategic plans.	Confidentiality Breach & Security Risk: Sensitive university data is transmitted to an unsecured third-party, potentially leading to unauthorized access, competitive disadvantage, or disciplinary action.
Using a public AI service to analyze a large dataset of survey responses from a class project, even though you removed names.	Re-identification & Privacy Breach: Even with names removed, the AI might inadvertently link seemingly anonymous data points or store the raw data, potentially making individual students identifiable and violating privacy regulations. This is a risk because the data is not public and can't be found on the web.
Relying solely on AI to write a faculty recommendation letter or grade an assignment without human review.	Bias & Unfair Outcomes: AI may introduce biases from its training data, leading to inaccurate or discriminatory evaluations, potentially impacting a student's future or compromising academic integrity.
Uploading unreleased course materials (e.g., lecture notes, exam questions, proprietary curriculum) to a public AI service for content generation or review.	Intellectual Property Loss & Academic Compromise: Your valuable teaching materials or secure exam content could be used by the AI provider, become public, or be accessible to others, compromising academic integrity and the university's intellectual property.
Uploading a large spreadsheet of student survey responses (even if you think it's anonymized) to a public AI tool for quick analysis.	Re-identification & Privacy Breach: The AI might inadvertently link seemingly anonymous data points, or store the raw data, making individual students identifiable and violating privacy regulations.

Common Questions

Common questions about data privacy and using AI tools.

What Data Can I Put Into an AI Tool?

Most AI ideas start with you — and that's by design. Create inside authorized AI tools. When your solution grows, IT partners with you to take it further. Learn more about using AI responsibly if you have any questions about using authorized AI tools.

Can I Use Student Information in AI Tools?

Are My Conversations With Copilot, CES ChatGPT, Gemini Private?

When you're signed in through BYU–Idaho's institutional SSO, your conversations are covered under our institutional agreement. Meaning they are not used to train AI models. This is a key reason why using your institutional account matters. Personal accounts do not carry the same protections.

What’s the Difference Between Using a Personal ChatGPT Account and CES ChatGPT?

A personal account, even one created with your @byui.edu email, is not covered by BYU–Idaho's agreement. CES ChatGPT, accessed via SSO, is covered institutionally. Always confirm you see "CES ChatGPT EDU" next to your name in the bottom-left corner.

Does BYU-Idaho’s Institutional Agreement Prevent AI From Training on My Data?

Yes, for approved tools accessed through SSO. This is one of the primary benefits of using institutional accounts over personal ones.

What Is the Difference Between Putting Private Data Into an Approved AI Tool vs a Vibe-Coded App?

This is an important distinction!

Approved AI tools have institutional agreements, contractual data protections, managed access controls, and audit trails built in. When you enter data into those tools, BYU–Idaho has legal agreements governing how that data is handled.

A vibe-coded app, even a well-intentioned one, has none of that infrastructure by default. The risk isn't the code itself it's the absence of the protective layer around the data. If your app needs to work with private data, that's exactly what IT is here for.

What Should I Do if I Accidentally Put Unapproved Data Into an AI Tool?

BYU-Idaho Authorized Tool – Contact IT immediately, and they have a tool to help.

Non-authorized Tool - Contact IT immediately.