We are a small community college in New York State, and are currently considering a contract with a vendor in Canada who would end up hosting portions of our student records in Canada. The data stored there will not include SS num, driver's licence number, credit card or bank number. However, it will include quite a bit of personally identifyable information (PII), as well as the student number.
I wondered if anyone who has done this would comment on what liabilities this particular situation would bring, and share any contract language that mitigates risk?
Finger Lakes Community College
Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/discuss.