Collaboration and Privacy
When you share a Dropbox folder with a user external to UC, the data in that folder does not count towards their quota. This is a feature of our enterprise Dropbox plan and unlike what would happen on any other plans. Note that the external user will still be shown the size of their quota, but nothing they upload to the folder you shared with them should count towards their quota.
The only people who can access your files are you and the collaborators with whom you selectively share your files. The owner or administrator of a folder can appoint other people as owners, so it is important to know who is able to share folders if you will be storing sensitive files.
In the case of an audit investigation, University systems administrators may be directed to access your account - as they are able to do with other IT services (such as email, desktop devices or networked storage drives). Such access is in accordance with the IT Policy Framework and the Staff Code of Conduct. If such a request is made, the systems administrator would access the account solely for the directed purpose of the investigation. We expect this provision to be used very rarely.
What not to Store on Dropbox
Dropbox data is stored offshore (the closest data centre is Sydney). If the data you work with requires storage within New Zealand, for example, health information containing personal identifiers, Dropbox cannot be used.
Sensitive data (e.g., personally identifiable research data) can be stored on your University Dropbox account if it is encrypted before uploading and if this complies with your funder and ethics requirements.
If you have concerns about the content or type of information you wish to share, contact the eResearch Support Team on ServiceNow and we can advise you on the best way to keep your data and documents private and secure.
Please note that you are still responsible for the data you place on Dropbox. Please be mindful of who you grant access to your files and consider that the specific requirements for your data may not align with Dropbox's capabilities (i.e. that some data should never be shared in its original form).
Alternatively, datasets can de-identified before uploading to Dropbox. Contact the Human Research Ethics Committee or the Animal Ethics Committee regarding human, animal, and biological safety ethics. Datasets that contain identifiers should be de-identified first before uploading to Dropbox. If in doubt, always encrypt your data and be mindful about sharing the data.
Māori Data
Where to store Māori data should be clarified with the iwi or hapū owning the data. While they may agree in some circumstance to store the data offshore, our default assumption is that the data should remain on New Zealand soil, which means that Dropbox should not be used in most cases.
When You Leave UC
When you leave UC (or just want to stop using Dropbox), it is important to manage your Dropbox data responsibly. You need to go through the checklist:
- Any “corporate” UC data should be moved to appropriate UC storage.
- Data you currently share with UC colleagues and to which they will still need access to after your departure needs to be transferred to them.
- Remove your personal data if you do not wish to keep a Dropbox account.
In the event you still have some personal data, or data you want to keep for your next endeavour, you can request to have your account to be transferred from an Enterprise account to a personal/professional one. If you are leaving UC, you will want to change the email address associated to the account as you will lose access once your UC account is decommissioned. You may be able to directly join your new institution that way if they also offer Dropbox storage.
