Identification (ID) Photo Use Policy

University at Buffalo (UB, university) students and employees must have an official university identification (ID) photo. The official university ID photo appears on the individual’s UB ID card. When a photograph is taken for the UB ID card or submitted electronically by the cardholder, it is stored digitally in university information systems and is part of the student educational or employee Human Resources record. Unauthorized saving, downloading, or using other means to capture an ID photo for purposes not covered by this policy is expressly prohibited.

The university uses UB ID photos in university information systems for approved educational and business purposes, including security and identification. Departments must request approval to use ID photos. Approval is restricted to the specific use or event requested and must not be used beyond the defined purpose. 

Prior to a student ID photo being used for social purposes (i.e., other than for security or identification purposes) the student must have given consent and faculty/staff must obtain approval for usage. Student consent is documented and maintained centrally; students may change their initial consent at any time.

For current employees, consent to use the ID photo for social purposes is assumed by their employment. A current employee may decline the use of their ID photo for social purposes through the Biographical Update for Employees form available on the Updating My Information section of the Information About Me webpage. New employees consent to use of their ID photo for social purposes at the time they receive their UB ID card using the UB Card Signature Form. 

The university maintains the privacy, confidentiality, and proper handling of ID photos. Photos taken for identification purposes are considered a form of personally identifiable information and are protected as required by federal and state regulations, university policy, and generally accepted privacy standards.

Individuals responsible for the administrative oversight of information systems associated with this policy must abide by university data governance principles, including but not limited to data roles, data access, and data use.

University policies and procedures relating to student and employee records apply to university ID photos and inform the UB community about appropriate access, confidentiality, and integrity of the official university ID photo. These policies and procedures include but are not limited to:

• Data Access Procedure
• Data Risk Classification Policy
• Protection of University Data
• Standards for Protecting Category 2-Private Data

This policy applies to the official university ID photo (UB ID photo). 

Educational Purpose

Purposes defined as educational by the Family Educational Rights and Privacy Act (FERPA).

Official University ID Photo (UB ID Photo)

The photo appearing on an individual’s UB ID card.

The official UB ID photo may be taken in 1Capen or uploaded by the student or employee. Uploaded photos are manually checked against photo ID criteria. The official UB ID photo is stored digitally in university information systems.

In accordance with the Data Risk Classification Policy, student and employee official university ID photos are categorized as Category 2-Private Data.

• For students (including students who are also employees), the official university ID photo is considered part of the student’s record and is protected by FERPA. The student’s official university ID photo is not considered directory information.
  

• For employees, the official university ID photo is considered part of the employee’s Human Resources record.
  

• Request approval from the University Registrar to use student ID photos for specific educational/business or social purposes using the Requesting Hub Access link.
• Request approval from the Director of Human Resources to use employee ID photos for a specific ID photo event (educational/business or social) using the Access Request for Employee Data.

• Serve as Data Steward for employee official university ID photos.

• Obtain an official university ID photo.
• Complete the Biographical Update for Employees form available on the Updating My Information section of the Information About Me webpage to withhold consent to use their ID photo in university information systems.

• Comply with data governance principles for access and use of official university ID photos.

• Obtain an official university ID photo.
• Provide consent to use photos for educational purposes and authorize or decline use for social purposes. 

• Serve as Data Trustee for employee official university ID photos.

• Serve as Data Trustee for student official university ID photos.
  

• Serve as Data Steward for student official university ID photos.
• Review and approve, as appropriate, requests to use student ID photos for educational/business and social purposes.