[Paper Review] Open Data, Grey Data, and Stewardship: Universities at the Privacy Frontier

Christine L. Borgman|arXiv (Cornell University)|Feb 8, 2018

Big Data Technologies and Applications27 citations

TL;DR

This paper proposes a framework for universities to balance open data initiatives with privacy protection by distinguishing between open research data and 'grey data'—administrative, instructional, and behavioral data—through ethical stewardship, joint governance, and privacy-by-design principles. The key contribution is a practical, institution-wide model for managing data stewardship that integrates privacy, academic freedom, and transparency, drawing on University of California’s governance innovations to address emerging cyber and ethical risks in data-intensive higher education.

ABSTRACT

As universities recognize the inherent value in the data they collect and hold, they encounter unforeseen challenges in stewarding those data in ways that balance accountability, transparency, and protection of privacy, academic freedom, and intellectual property. Two parallel developments in academic data collection are converging: (1) open access requirements, whereby researchers must provide access to their data as a condition of obtaining grant funding or publishing results in journals; and (2) the vast accumulation of 'grey data' about individuals in their daily activities of research, teaching, learning, services, and administration. The boundaries between research and grey data are blurring, making it more difficult to assess the risks and responsibilities associated with any data collection. Many sets of data, both research and grey, fall outside privacy regulations such as HIPAA, FERPA, and PII. Universities are exploiting these data for research, learning analytics, faculty evaluation, strategic decisions, and other sensitive matters. Commercial entities are besieging universities with requests for access to data or for partnerships to mine them. The privacy frontier facing research universities spans open access practices, uses and misuses of data, public records requests, cyber risk, and curating data for privacy protection. This paper explores the competing values inherent in data stewardship and makes recommendations for practice, drawing on the pioneering work of the University of California in privacy and information security, data governance, and cyber risk.

Motivation & Objective

• To address the growing tension between open data mandates and privacy protection in academic institutions.
• To clarify the distinction between open research data and 'grey data'—non-research, administrative, and behavioral data collected in daily university operations.
• To identify the ethical, legal, and institutional challenges universities face in governing diverse data types while upholding academic freedom and intellectual property.
• To propose actionable governance models that embed privacy and ethics into data practices across teaching, research, and administration.
• To provide a roadmap for universities to manage data stewardship without compromising innovation, transparency, or public trust.

Proposed method

• Analyzing the convergence of open access policies and the proliferation of 'grey data' in university environments.
• Drawing on the University of California’s institutional governance models, including joint faculty-administrator committees and privacy boards.
• Applying foundational principles such as privacy by design, Fair Information Practices, and the Belmont Report to data stewardship.
• Using case studies and institutional experiences (e.g., UCLA and UCACC) to illustrate practical implementation of data governance frameworks.
• Developing a five-part recommendation framework: beginning with first principles, embedding ethics, promoting joint governance, ensuring transparency, and avoiding panic-driven data hoarding.
• Evaluating risks across data access, misuse, public records requests, cyber breaches, and curation for privacy protection.

Experimental results

Research questions

• RQ1 How do open access mandates and the accumulation of grey data challenge traditional data governance models in universities?
• RQ2 What are the ethical and legal responsibilities of universities in managing data that fall outside standard privacy regulations like HIPAA and FERPA?
• RQ3 How can universities balance transparency, privacy, academic freedom, and intellectual property in data stewardship?
• RQ4 What institutional mechanisms can effectively govern data when stakeholders include faculty, students, administrators, and external partners?
• RQ5 How can universities proactively protect privacy without stifling innovation or data reuse in research and administration?

Key findings

• Universities are increasingly responsible for managing vast, diverse data sets—both open research data and non-regulated 'grey data'—that blur the lines between research, administration, and surveillance.
• Many data sets, especially grey data, fall outside traditional privacy regulations (e.g., HIPAA, FERPA), creating regulatory and ethical blind spots in data governance.
• Joint governance involving faculty, students, and administrators has proven effective in building trust and creating sustainable data policies, despite being time-consuming.
• Implementing 'privacy by design' and embedding ethical reflection into data practices can reduce long-term risks and enhance institutional accountability.
• Overreaction to data risks—such as locking down all data—undermines innovation and limits the value of data for research and learning.
• Transparency and proactive communication about data use are critical to maintaining public trust, especially after high-profile data breaches at institutions and corporations.