Responding to Requests for Data Provided on Third-Party Technology Platforms

If Yale receives an informal request for data from a third party, we typically insist on receiving formal legal process before complying with the request.  If Yale receives a formal request (such as via a subpoena or other legal process), we confirm that the request is lawful and evaluate all available legal options for responding. We do not readily share data for purposes other than legitimate educational uses by or on behalf of Yale or by someone requesting access to their own data. 

Our vendor agreements are designed to restrict vendors from sharing data without Yale’s permission. We expect vendors to inform Yale immediately if they receive a request to provide Yale data and not share such data without Yale’s consent or a binding legal obligation to do so, such as a court order. 

Yale-supported technology refers to third-party technology platforms that have signed agreements with Yale and undergone an evaluation to assure compliance with Yale’s minimum security standards and other policies governing data security. (Learn more about Yale’s Security Planning Assessment process here.) The agreements that vendors sign with Yale establish data security requirements that are appropriate for the kinds of data involved. Providing your data to platforms that have not signed an agreement with Yale or undergone Yale’s standard security diligence may put your data and the University’s data at risk. 

If you provide information to a third-party platform that does not have an agreement with Yale, Yale may have limited recourse to prevent the vendor from sharing your data. This is one reason Yale-supported technology should be used for conducting Yale business.