text:
Am I required to hand out private encryption key to head of institute?
I am a PhD student at a German university. Motivated by a longer absence of a (technical) coworker due to illness, the accessibility of data of the members of my institute has been discussed for such cases. My computer is owned by the institute, but I am the only one using it, and I have completely installed and configured it to my liking. In particular, I am encrypting my data. I do have some private data on that computer as well, e.g. emails since my private email account is linked in my email program, but also some music, and perhaps a few photos, my private PGP key, etc. The setup is pretty similar to some of my colleagues.
Now, I was asked to either physically or digitally hand over my private encryption key (or password) in order to get access in some emergency case. Apparently, my colleagues have done so already. I feel very strange about this, since I grew up learning that passwords should never be given away. I have raised my concerns, e.g., that this would also enable access to private emails or other data, and allow to send emails in my name.
But these were marked invalid, since private data has nothing to do on my work computer (even though everyone uses it that way).
Alternatively, I was told I could unencrypt my hard drives.
My questions are:

Am I required to hand over my private encryption key by law?
Morally, how would I best act in this situation?
Should I hand over a wrong (digital) private key and hope that this situation would never happen?
Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access? I do not have to mention this anywhere if I hide the container good enough...(maybe that is not even necessary).

It is probably worth to note that no one is really involved in my research topic, i.e., no one really depends on my data. I could however imagine someone to be interested in possible (unpublished) results in the case I am gone.

You make a great argument for keeping your personal stuff separate (completely) from your professional stuff.

Comments are not for extended discussion; this conversation has been moved to chat.

I was asked to [...] hand over my private encryption key --- Who asked you exactly? Your PI / superior, or the IT staff?

I was asked by the second highest member of the institute who is in charge of a lot of organizational stuff, in the name of the head of the institute (who is my professor and PI).

Related: Is it OK to tell your password to your company's sysadmin?

OP: when you say "In particular, I am encrypting my data", you don't mean drive encryption, which is pretty standard (at least in companies, not universities) these days. Is your motivation mainly privacy, i.e. so your coworkers can't see your personal emails or personal files? Is your work data confidential? under NDA? Do you have any work-related reasons?

@smci My motivation is mainly privacy, i.e. my work data is not confidential and there is no real work-related reason besides perhaps strategic (I don't want to compare myself to giants like e.g. Leonardo da Vinci who has encrypted his notes, or Andrew Wiles who has not even told anyone that he is working on FLT, etc. so the motivation is certainly not something uncommon i believe...)

I have talked to the data protection officer of my university, who seemed very sensitive with regards to my concerns. So in fact, the university officially allows a small amount of private usage of computers - without explicity defining small amount. There also is a policy for emergency cases, where the head of the instite is not allowed to simply access the computer, but instead the data protection officer (or some member of his team) makes sure that no private / sensitive data is made accessible, and only then allows the head of the institute to access the data. He then basically confirmed, that this is an infrastructure problem, and that the university offers tools to circumvent any kind of password hand out (e.g. backup and server-storage with fine-grained access control, mailing lists, etc.).
He also mentioned that there are different ways to proceed (which I can chose from): He could generally talk to my institute without referencing me or any details of the current discussion, just for a general clarification. Or instead reference me and talk to the institute. Or do not talk to the institute at all, and I will figure out what I need to do by myself.
Anyway, he did say that handing out private keys or passwords is the wrong solution to a problem that should not even exist when using the correct tools that the university offers.

I am glad to hear that; thanks for coming back here to share the solution that worked for you!

This seems like an X-Y problem. Why is important work data only kept on a computer on your desk, in the first place? I would expect it to be on a Git repository, or on the shared storage space of a workplace server.
Once you fix this problem, the issue you mention becomes irrelevant: your data will not be lost if your disk suddenly becomes inaccessible.
So a practical way to address the issue could be offering to put more of your work data in shared servers and git repositories, so that the problem disappears. Ask your superiors which data they are worried about, and offer to keep them online preemptively.

I do have certain data in git repositories. But since none of my colleges is really working on my topic, I decide what is important. But the question is less about backups of important data (which I have), but more about the desire to have access to all of my data.

I use duplicity to push my data (or more accurately the deltas) nightly to an offsite server for backup. The server is then backed up to tape and the tapes moved to a third site on a regular basis. Everything is encrypted. If everyone with the passphrases to a data set were to die, the data would be lost (maybe a government agency could break the encryption, but the $5 wrench wouldn't be of any use).

@emma Enough discussion on that the way you use IT infrastructure is not professional. I also hope you agree with the many voices suggesting to make the work related data available. Instead of handing over the key, this is the moment to change data handling. I suggest to talk to your university IT if they can give you some (automatically backed up) shared network storage used at least for work related data backup for you and co-workers. We have it like that at a German university and even work most of the time directly on that storage. The university network is sufficiently fast in many cases.

This would in general not solve the problem with encrypted work e-mails.

This is not a X-Y problem at all because we are answering the OP's issue (how to respond to a request for encryption keys) not the university's issue (whether or not to ask for the encryption keys). Telling OP that the university's set-up is wrong doesn't help her solve her problem.

@JBentley It does if it provides an alternative to handing over private keys

+1! @emma In a very similar working position I had my hard drive fail lately, very scary. All data could be recovered but it was a long process. My advice: Have IT set up some virtual server for you, if need be with access rights only for you. Security is their concern and expertise, not yours. Learn about their backup policies. Consider your personal work computer as a calculator/web browser/typewriter, any data should only be in transit (or present on the hard drive as a weak backup). Use the browser for private mails.

Whereas you might (opinion based) be right, this does not answer the question.

@Dubu OP does not mention encrypted work e-mail, only encrypted private mail which, for convenience, is handled by the same client. I presume the two are on two separate addresses, and with two separate encryption keys (if work e-mail is encrypted at all); in this case there is no problem.

@JBentley I have added a paragraph with practical advice on what to do. I hope this addresses your remark.

@JJMDriessen this is a great example of how not answering the (literal) question can sometimes result in the best actual answer.

@DanRomik Not really, because it assumes that the OP has the power to direct her university to change its IT policies and overrule its request for encryption keys, which is not by any means a reasonable assumption (albeit the new edit softens the assumption slightly, but the answer still relies on the university cooperating with the request). In such cases it is better to primarily answer the literal question, and offer this kind of advice as a side note.

@JBentley From OP's description it seems that there isn't a real "IT policy" written in stone here, just a moment of concern by her (academic) superior, motivated by a recent event. In my experience this kind of policies is a lot more blurred and negotiable in the university than in industry: for instance, see the other comments on this page about personal and work use in university. So if you are used to how things work in industry, be warned that this mindset may not transfer directly to an academic setting.

@JBentley the voting public disagrees with you. I’m not saying this answer is perfect or says everything there is to say on the subject, or that your criticism of it has no merit, but simply speaking it’s the most insightful and to the point among the existing answers, and that is true even though “it doesn’t answer the question” in the narrow technical sense.

@Dan Romik I disagree. The answer makes an idealistic assumption. Most probably, if there was a healthy network system including shared repositories, then this demand of password sharing would not have been made in the first place. At most the OP could suggest the use of such a system. What if they don't bite? Is the OP still required to give his encryption key? I too am interested in the answer to OP's question, but frankly this post doesn't provide it. The fact that it has received many votes doesn't change that.

I am going to (partially) disagree with some of the answers here. I think it really depends on who is asking for your key, and based on what policy.
First of, I am more than confused by the many answers here assuring that the university has in general no business accessing information on the computer they provided you - the IT usage policy in all institutions I worked at so far (in Austria, Switzerland, and Sweden) would certainly disagree with this stance. Sure, the lived practice is that they give you a computer and then don't care much about what you do with it, but the fact remains that it is the university's computer, and that you also use it for private things (maybe with their explicit permission) does not change this fact.
However, if the (somewhat silly) plan of requesting private keys is appropriate depends on who made this request - if this is actually part of the written IT policy (very unlikely) your options are to give them the key or stop using the equipment they provide, but if it's just a wild idea of your PI you have all the right in the world to just say no. "Your" computer isn't really yours, but it also isn't your PI's. Even if they paid for it through their grants, the computer belongs to the university, and university policy governs how they are managed. I am also fairly sure that your IT department would back you up on this if push comes to shove, because a supervisor (or whoever) storing a bunch of private keys or passwords sounds like a liability / traceability nightmare that nobody wants to deal with.

Morally, how would I best act in this situation?
  Should I hand over a wrong (digital) private key and hope that this situation would never happen?

Certainly not - that's just as silly as asking for the key in the first place, and if your PI wants to test it (every backup solution is only as good as the last time you tested it) you may run into major conflicts. It's much better to acknowledge that their concern is per se not unfounded, even if their solution approach is bad, and to work with them on a better solution. Having a cloud service for data backup would be an obvious approach.

Instead of rebelling, I am thinking to give access to part of the system only, i.e., put certain data in an encrypted container that they cannot access? I do not have to mention this anywhere if I hide the container good enough...(maybe that is not even necessary).

Unless there is some deep distrust between you and however is requesting this key I don't see why they would mind if you had a separate "non-work" partition (assuming that they allow private usage in the first place). That said, as I mentioned before the whole idea of collecting private keys / passwords is a bad solution to the problem anyway.

If it is about a private encryption key that anyone asks from me, I do have deep distrust towards this person, because this just does not sound like the right solution to any problem, as you mention. The idea with contacting the IT department of the university is a good one.

Why can't the PI ask for the password?  The person is the principal investigator, the head of that particular research.  So it doesn't make sense that PI wouldn't have access to the computer even if it was paid by grants.  I don't think  @emma has the authority to go to IT and request something above her supervisor.  Collection of passwords is supposed to be kept in a password software with high encryption. Simple.   I agree, that any colleague, without supervisory request, should ask her for her computer's password.

@Mugé No one should ask for anyone's password. Data that is required to be accessible in case of emergencies should be stored in some place where certain people (PI, professor,...) have access. If this place is understood as my hard drive, well then I feel like an encrypted non-work partition on this computer is the solution to my problem.

@emma I believe this assessment is correct. They consider your hard drive to be the storage where people should have access to. I agree with your solution that you can simply separate the partition for work and non-work.

@Mugé PI != dictator. Workplace policies also apply to PIs, as much as some PIs wish this were not the case. As for why the PI should not have the password: consider the case that emma's laptop / account gets used for something illegal, how do you determine who of the two actually did it? No IT department wants to deal with this.

@xLeitix Why would a PI sabotage their own project?  Are we talking about the same PI who is the principal investigator of a research project who, let's say, is in charge of the study, not some other PI.  It is actually the IT people who should not get into data / computer without consent by an authorized person.

@xLeitix Mind you, I had a dictator, micro managing investigator who even took my hand notes at the end of the study.  Not some study calculations, but my notebook.  I mailed it to her thinking, good luck reading all that  :)

@Mugé Let's use a realistic example - say the computer / account has been used to download copyrighted movies, and the copyright holder threatens to sue. Who does the university blame? (or, if you want a more drastic example, replace copyrighted movies with child pornography)

@xLeitix That is why, my isolated answer section states no personal stuff should be in a work computer, especially not of sensitive nature.  One should not make a habit of using work computer for personal.  Even if IT needs access to that computer, this will still need permission whoever is in charge.  Unfortunately, your example will effect the university/ workplace rather than the individual who gets suit.  The workplace will have to pay for it.

@emma They aren't asking for your password; they're asking for your key. Most disk-level encryption systems support multiple "key slots" specifically to handle this scenario (the symmetric key is encrypted under your password but also some organizational-level recovery key).

Morally, how would I best act in this situation?

The moral thing to do is first of all to recalibrate your somewhat immature (in my opinion) attitude towards this question and stop trying to think about dishonest solutions like giving an incorrect password or undoing the system-wide encryption but hiding encrypted content on your system and not telling anyone about it. Whether or not you should agree to give the password is a separate question where the answer would be more nuanced, but certainly if you care about behaving morally, do not lie to your supervisors. Any option that involves dishonesty should be unconditionally off the table.
As for the question of whether to give the (correct) password: first, I think it’s reasonable of you to find the policy a bit draconian. I myself am a person who cares a lot about privacy, and as most academics do, I sometimes use my work email for private purposes, so I get where you’re coming from. I wouldn’t want my employers going through my emails. But I also am perfectly aware that they have the right (and technical means) to do that, so if I need to send something especially private or sensitive, I use a different, private email that is protected by a separate password and is not physically stored on my work computer.
What I find unreasonable however is that you are complaining about the policy and how it infringes on your privacy rights, without looking at things from the institute’s point of view, acknowledging that they are trying to solve what is a real problem for them, or offering a solution that might make the violation of your privacy unnecessary. It would be completely reasonable and honorable for you to go to your department chair (or other relevant administrator), say you object to the policy and offer them an alternative plan that ensures accessibility of your work data in unexpected events. A smart administrator would be willing to negotiate a solution that keeps their researchers happy while still meeting the institution’s needs, so I’m optimistic that a solution can be found. And if they don’t agree and just insist that you hand over the password? Well, then, the mature, professional thing to do is to follow your institution’s policies, even if you disagree with them, and vow to behave more reasonably in the future when you yourself someday become an administrator.
Finally, I want to share with you an insight I had one time during the years I was a department chair. I noticed that regular employees have a different approach to risk (of all different kinds) than administrators do. A regular employee will often be willing to ignore the possibility of low-probability events happening and choose a more risky path when making a decision, but administrators are much more sensitive to such things. The reason is that from your point of view, the low probability event of you falling very ill (to use your example) or otherwise not being available to provide coworkers access to your data seems like an outlandishly unlikely event that is like nothing you have experienced happening in your lifetime. But from the administrator’s point of view, they actually see low probability events happening all the time, somewhere in the organization. Those events are not at all “low probability” from their point of view, and it is precisely the administrator’s job to put in place policies that protect the organization in the actually very likely event that such things end up happening to someone.
So what I’m saying is, the administrators aren’t necessarily being as unreasonable as you think with their data protection policies. But of course, it’s reasonable to want to have some privacy as I said, so it isn’t obvious to me that your objections are completely wrong or misguided. Anyway, good luck.

The questions were not meant to be connected necessarily. I am trying to understand the different options at hand, and while I generally consider myself on the moral side of things, lying still is an option. I do not think it is a policy to hand out private encryption keys, anywhere. Generally, you are correct about the different perspectives on risk. But having (perhaps personal) backups, and giving access to them are two different stories. Also, I do acknowledge the problem. But as commented somewhere,

I find the solution to be a very bad one - though the easiest from a technical point of view, since there is no need to solve the real problem: An institute wide backup infrastructure with good access control. And maybe this is also the reason for suggesting this in the first place..

@emma understood, and I commend you for being open to hearing people’s opinions and wanting to learn about your options. At the same time, the fact that you still consider lying an option reinforces my opinion that your approach to the problem is a bit immature. Anyway, if you want to lie, it’s not my job to stop you. Hope you find a good solution!

P.S. re: “I do not think it is a policy to hand out private encryption keys, anywhere”, I think that’s a misleading statement to make. It was you who set up a “private encryption key”, and there isn’t any sense in which you are automatically entitled to set up such a key on a work-owned computer. So as I said in my answer, I think you are suffering from a blind spot here and are seeing a one-sided view of the situation that focuses on your own rights and own sense of entitlement while ignoring the legitimate rights and concerns of the institution.

I disagree. Yes, it was me who set up the encryption, because there is no policy that prevented me from doing so. I have understood and used the computer as a tool to sculp my thoughts that hopefully result in some scientific result. I consider these thoughts private as long as I don't find these relevant enough or as long as I think it is not the right time for it (e.g. because they are half-baked  or whatever). I think I would have worked very differently without this freedom. In my (theoretical, math related) field I need the space to do stupid things without feeling

exposed to anyone in order to come up with creative solutions. Besides, there may be strategic reasons why one would hold back certain results.

@emma sure, I understand why you think the policy is unwise. I’m not even saying you’re wrong about that. But the fact remains the policy is what it is. Your options are some combination of: 1. comply, 2. argue to have the policy changed or be granted an exception, 3. buy a laptop with your personal money and use it to write down the half-baked thoughts you want to keep private. What you said doesn’t change my opinion about you having a blind spot.

I think your observations regarding risk are very apt. What's even more is that we all know deep down that if something happens that would require somebody else to gain access to your computers, work would probably be the least of our worries. So even when we do think about catastrophic life events, we rarely do it in terms of "how will the department get access to the mid-term grades of my students?".

I also think that risk perception analysis is correct. Yet, I strongly disagree with the black-white attitude towards the conduct with the superiors/institution. This is a business. If you are not going to protect your interests, nobody else will (including your supervisors). Honesty is of course important, but only if it goes both ways in a good faith environment. Being naively forthcoming and open will result in you being taken advantage of. This is why there are rules, contracts, obligations, etc. in place - by interpreting them you and your employer can protect your respective interests.

I've heard enough IT anecdotes on "bus error"--the original developer is hit by a bus, so dozens man-years of code need to be rewritten from scratch. It seems that your "administrators tend to take less risks" weights this in at least partially.

@emma I like your honesty.  See what kind of debate you created.  I hope you change your mind on your opinion and create something for Germany's future in your university.  This should be an indication by those who know better.  But nice you made an issue of it.

In my field this would certainly be a no go. I work with human subjects and our IRB approval lists who has access to our data. These data management plans outline who, how, and where the data are stored and backed up. This means either encrypted files (typical) or encrypted drives/partitions. I have never seen a data management plan that would give IT support permission to access the data. The plans do not go so far as to prevent "evil actors" from accessing encryption keys from RAM or performing cold boot attacks, but they almost all require access to the data to be limited to named individuals.
I also run Linux and all the computers in my lab use full disk encryption. I assume that i the university wants the computer back (or needs access), they will wipe the computer and reinstall the OS. All data and information on the computers are stored in accordance with departmental/institutional storage requirements.
If your department head wants a particular type of data stored in a particular format and in a particular location, you do that (assuming it does not violate other regulations). This might mean all data gets pushed to a USB driver or a server. It might mean you boot and run the computer off a USB stick and never write to the hard drive.

I have never seen a data management plan that would give IT support permission to access the data ... in the specific field you work in. In other places this is the obvious solution (in case something goes wring with the encrypted data)

@WoJ IRBs are field independent and data management is about protecting PII and PHI. Of course there are other concerns (e.g., HIPPA and FERPA come to mind), but human data under IRB control is a chunk of the data produced in academia.

human data under IRB control is a chunk of the data produced in academia yes, this is certainly true and an example of many possible cases. The OP has a generic question and their systems seem to be quite far from that case ("It is probably worth to note that no one is really involved in my research topic, i.e., no one really depends on my data. I could however imagine someone to be interested in possible (unpublished) results in the case I am gone.")

HIPAA (not HIPPA) and FERPA are irrelevant to OP, although Germany may have similar laws.  Not sure how the demand for access relates to GDPR.

You may want to consider avoiding excessive use of industry-specific acronyms: to the layperson your last comment is indecipherable (IRB, PII, PHI, HIPPA, FERPA).

Clearly yours in an exceptional case with atypical regulatory obligations.  There should be no expectation that a typical research environment would have to, or would even be well advised to, conform to the same regulations or operational frameworks.

@J... my example, while specific, is not unique since all human subjects research needs to ethical approval. The point was to highlight that the policy does not work in general and that there is an entire group of researchers who would not be able to comply with this request. I then go on to point out possible solutions that do not involve deceiving anyone.

Yes, but at the same time most research in the academic world has nothing to do with human subjects and we have no reason to believe that OP's institute is involved in such research.  It's also not uncommon for employers to maintain full administrative control of their IT resources.  Even if OP had such constraints on where their data had to go (presumably not on their laptop), it would not be unreasonable for their provided laptop, with exception of the sensitive research data, to remain otherwise fully accessible by the organization.

I would bet that somebody else has access to the encrypted data on your disk, even in the medical field. Because otherwise what happens to it if you die?

Generous of you to assume that OP's lab has a (good) data-management plan already laid out! It sounds like this situation was caused by them realizing they didn't have one.

In my experience, academic staff (including PhD students) are usually given great latitude about managing their own computer as long as they are able to take care of it themselves. It can be understood as an effect of academic freedom (in the sense that the researcher is free to use the tools they like), but on a more pragmatic level it also saves the institution some IT resources if most researchers maintain their device themselves. To some extent it's as if there's an unwritten rule in academia that in exchange for not requiring too much IT assistance, the researcher is free to do whatever they want with their computer. In any case this means that strict industry-like standards rarely apply in this domain: researchers commonly use their work and personal devices interchangeably, in the same way that they often don't make a strict distinction between their work time and personal time.
Given the traditional absence of data management in academia, it looks to me like the institution is just trying to apply a questionable quick fix to a sudden problem, instead of taking the time to design a proper solution. I would note that the "solution" is unlikely to work in the long term, because it requires:

A well-maintained repository of devices with their corresponding username and passwords/encryption keys
Every staff to comply and provide their password every time they change it or re-install the OS (it's unlikely people will remember after a year)
The IT staff to check regularly that they can access everybody's device (that's just not going to happen)

Additionally depending how the repository is maintained it could be a serious security risk, since a hacker gaining access would get access to many devices and potentially a lot of sensitive data. If it's stored very securely and only one person can access it, then it doesn't solve the original issue: what if this person gets sick or worse?
I'm not a legal expert, but I doubt this solution has been legally assessed anyway. I would suggest to inquire about the exact details of the policy and ask colleagues how they dealt with it. You might want to suggest alternative solutions: data sharing software and collaborative tools are not in short supply, in my opinion it would be a much more suitable approach.  As a PhD student, you should probably discuss this with your supervisor, at least to get a sense of how serious these requirements are (you might want to mention that this policy could hinder your productivity). In case your supervisor tells you not to take this too seriously, you can consider yourself off the hook.

You never give away passwords or private keys. In Germany you cannot be forced by anyone to do so.
Look in your contract.
Is private use allowed? (email, surfing, etc). Then ask for a server, external drive and store the property of your institute.
If not (computer may only be used for working purposes). Well then get your private stuff from the computer, decrypt it and hand it over.
But the best place/person to discuss it is the Data Security Officer (german: Datenschutzbeauftragter).
Because the usage of private data is obviously not clearly communicated and the usage of encryption on personal devices seems a bit vague, I would contact him/her on base on
Article 39c of the DGSVO (General Data Protection Regulation) --> https://dsgvo-gesetz.de/art-39-dsgvo/. Because there might be some issues in the handling of giving computers in your institute. These need to be solved for the future and for you.
(--> https://dsgvo-gesetz.de/art-35-dsgvo/ and https://dsgvo-gesetz.de/erwaegungsgruende/nr-75/)
However the Data Security Guy is normally a nice guy and will find a solution and the solution will never be be to reveal your key.

I do not understand why you want to have private data in a company computer. Your claim of not being able to separate professional from private is highly debatable. Only data that has something to do with the job and acquired according to the IT policy of your institute should be on your workspace computer. For other stuff such as music and private emails, you could use your phone.
From an ethical point of view, using workspace resources for personal gain ( whatsoever) is unprofessional and could harm your reputation.
As for your concern, I suggest to remove your private data from your workspace computer and follow the institute IT policy.

I have been involved in reputation-related chit chats with dozens of academics. The thought of somebody gaining a bad reputation for storing private information on their computer sounds nothing but silly to me.

I do not own a smartphone. A laptop would do, but then I would probably work on my laptop rightaway. Also, I disagree. Listening to music for example benefits my creative thinking which is necessary to come up with solutions. Personal gain? Maybe, but surely a professional gain as well.

@lighthousekeeper , no problem when it is "their computer".

This is just not how academia works in some many places. If I have dinner and drinks with a colleague is that work or personal? What about when they send me a photo of their kids (possibly playing with my kids)? Most of us mix personal and work much more so than in industry.

@sapienswatson with "their computer" I mean "a computer provided to them by their university/organization"

@emma , I am not debating the importance of music. I am an IT guy and I believe that following the IT policy will benefit everyone.

@sapienswatson we fought IT and got policies changed because IT failed to understand how the work needed to be done. IT just came up with a "policy" that sounded good...

@lighthousekeeper, From what OP  said i assumed there is a policy. As long as the IT policy allows you no one will blame you. I assumed that the IT policy does not allow for such practices.

@StrongBad It is even worse at certain institutes where they organize all sorts of leisure time activities for colleges to make them feel as if it is not work, because after all, you would spend more time at work, talking with passionate researchers and finally produce more results too. E.g. they have a "beer hour" every week at some institute that I've worked at where you would expand you horizon, or talk about private stuff if you feel like it..After all, the institute will not complain if you produce good results, no matter how they came up.

-1 since buying your own personal laptop separate from a professional laptop is expensive (very much so for low-salary PhD candidates) and extremely inconvenient.

@einpoklum, You do not like a rule, you start negociating. You do not break a rule because you do not approve to. I hate paying taxes! They are quite a burden, maybe I will just try to find a way to trick the law. This was an analogy to your dilemma.

I think you have one core misconception: The machine is a work machine, as such it is not your private encryption key, it is a custom encryption you applied to a company/institute machine. It's the institute's machine and primarily their data and their right to determine how you use that machine. They may allow private use and they may allow you encrypt stuff, but that is up to them. If your personal encryption scheme conflicts with their policy, you loose. Now, the typical proper use-case for something like this would be that IT department has a master key that they can under certain regulated conditions use to lookup data needed for professional purposes. Potentially with a 4-eye procedure to make sure they don't look at stuff that is not in their professional interest.
However, as is often the case in academia, things aren't that well organized and a more pragmatic approach is used. This seems to be the case here: There is no standardised encryption in place, and you are allowed to do private stuff on your machine. You are even allowed to manage your security yourself, but they ask to have access to it in case of an emergency. Now, while the method to ask for you password may not be the best, it seems like a reasonable way to satisfy your need for encryption and their need to get to the data.
Of course you can suggest alternative solutions, like having central servers that maintain all data and you not being allowed to have any essential data solely on your machine (you may get quite a bit of an argument from your colleagues, if they prefer to keep their data on their machines) or having separate hard drives/partitions and the like. A personal container with private data might be fine. But ultimately you have to convince them and if you cannot, they have the last word in this. They give you an option to not encrypt, which doesn't involve handing over your password if this is such a big issue for you.
Note: the encryption password should not be the same as your system user password etc. anyway such that misuse should be limited to direct physical access misuse, which you should be able to prevent by having your laptop with you all the time.
Is handing out the password problematic from a security perspective? yes, in the sense that it lowers security. Is it their decision how to use their machine? Yes!
(within lawfulness, but bringing up laws might mean they have to draw up a proper policy that restricts you far more than their current approach).

The institution's solution seems unworkable.
It is well known that professional resources - e.g., equipment (including computers, photocopiers, and shredders) and the mail room (where personal items may be sent) - are used by employees. It is also well known that personal resources - e.g., equipment (including smartphones and texbooks) and home offices - are used for work purposes. Such use benefits both employers and employees.
Rather than caving to the institute's demands, a workable solution could be proposed. For instance, moving shared data to a server accessible by collaborators.

Yeah, this is kind of what was meant with unencrypting the hard drive I guess (=making it accessible by certain members of the institute).

@emma I think a server provides a better solution than a personal computer can

But it requires administration of a server.

Centralised solutions provide more accessibility (which is the goal here) and administration can be delegated to IT.

If done right, the case you currently have can be used to strongly advocate for a server. Just imagine if the person was not only gone for a few weeks but suddenly leaves the institute. Or if one of your machines crashes and is not recoverable. Or you accidentally delete all your stuff. Or ... Every work environment should have a proper storage and backup procedure, if possible setup and administrated by IT professionals.

I have helped to manage the IT for an academic group for a while, and students or employees keeping research data only on their individual PCs was a very typical problem. It is important for the university and your PhD supervisor to ensure that they have the data that you produce. This is also a requirement for many grants that actually pay for the research, your supervisor is required to ensure that the data created is stored in some accessible way. This is not an arbitrary request, your supervisor is likely violating the terms of some research grant if they don't ensure proper management of the produced data.
This doesn't mean that you have to give them your private key, a much better way is to ensure that all relevant data is stored somewhere else than only on your PC. For example a central file server with proper backup procedures in place.
What your institute is asking for is a bad way to solve the underlying problem, especially as it doesn't solve a major reason for data loss like hardware failures.  But they do have the right to insist on having access to your research data, and you should propose an alternative that fulfills this requirement like e.g. syncing your data to a file server of the institute.

Here is my understanding including the legal situation in Germany. IANAL, but I've had occasion to read up on such issues.
First of all,

Motivated by a longer absence of a (technical) coworker due to illness, the accessibility of data of the members of my institute has been discussed for such cases.

This sounds to me as if your institute is right now in the process of developing such a strategy. That is good news for you, as it gives you a chance to suggest improvements.
Thus, I think you have the genuine and actually rare chance to contribute constructively to your institute becoming much better than most institutes in this respect. Do that instead of rebelling.

I am encrypting my data.

That's fine. Still,

The bus factor of your PhD is obviously 0 since you are required to hand in a substantial chunk of original own work. However, in case you suddenly leave the project, others may need to access your work in order to save as much of the project as possible. This is probably part of the risk strategy outlined in the grant proposal, and this means your institute signed a contract with the funding agency that they have reasonable means to save the project in case you drop out/get sick.
The university/your institute/your PI are typically required by the project funding agency to guarantee accessibility of the research data that belongs to the project.
So it's not only their whim, they have signed that they can show everything from raw measurement data to lab books if needed.

Bottomline: Asking you to ensure others can access your project-related data is reasonable and sensible, and they probably signed contracts that actually require this.

If you have an employment contract with your university, the university owns your work. In consequence, they have a right to access it and you must provide them with appropriate means to do so. Actually, they may legally ask you to not even keep a copy of your project data when you leave.
In my experience, some instituates do excercise this right while many institutes are fine with you keeping a backup copy of your data: in case something is needed/there are questions later on, it is often easier to ask you to send them the data (and of course, your ability to answer questions without access to the data is limited) and of course it is a kind of a distributed backup strategy.
Personally, I'm somewhat uneasy with the request to not keep a copy of anything as my professional reputation potentially depends on whether I can answer questions (and possibly show data) about my papers years later. But legally, there's no choice here: it's the employer's (institute's) responsibility if they choose to excercise their right to exclusive data ownership.

Now, I was asked to either physically or digitally hand over my private encryption key (or password) [...]  I feel very strange about this, since I grew up learning that passwords should never be given away.

You are right in not sharing your private key or password.

You probably signed with the IT policy (see below) that you will not give your password to anyone.
As you correctly point out, someone may gain access to your accounts and may do bad things(TM) in your name: sharing passwords creates a nightmare wrt. responsibility (it's impossible to know who exactly did X - and for you it's impossible to prove that it wasn't you)
A closely related issue is data integrity. If you grant change/write access to anyone (via password or otherwise), how can you be sure things are as you left them?
The answer to this however is signing rather than encryption.
And moreover, it is not necessary as you can grant rights (e.g. group-readable) according to the required access level.
So that's what you should do: possibly create a "project" user, make the relevant data readable to that user and hand over that login to your PI.
An alternative is to have a shared drive on a file server for the project - but that's IT infrastructure that is outside your control. If it exists it's probably good to use that as these are in my experience typcially run with backups etc..

I'd like to exand a bit on my understanding of the legal situation in Germany wrt.:

I do have some private data on that computer as well

You have probably signed an "IT use" document when starting as PhD student. Time to review that.
Regardless of whether the IT policy of your university does allow small-scale private use of university IT, IMHO the best container for your private private data is a private external storage which you keep.
However, you may also have work-related private data => see below.
AFAIK, two scenarios are common in Germany wrt. IT use policy:

Employer/university allows small-scale private use. They are not allowed to access your private data. As they allow private use, the default assumption is that your computer contains private data, and it should therefore not be accessible to everyone.
So in case that's the policy at your institute, you can keep such personal data in your own encrypted storage.
However, AFAIK employers can also mandate that their IT infrastructure is strictly for work/research purposes only. In that case, you may be expected to have almost everything at least readable to other employees.
Still, As @StrongBad points out, it is actually quite common to have encryption (or physical access restriction) mandated e.g. by

Privacy requirements for projects involving human subjects,
Certain professional positions also mean that part of the work data should not be accessible to your whole group, and possibly not even to your PI/professor. Examples are data related to positision as ombudsperson, Fachschaft [student union] or Personalrat [employee committee] work, and everything related to grading students.

The conclusion is that the institute actually needs a more fine-grained access policy than just "everyone can access everything if need be".

Having files with group-readable access rights doesn't really work when the data (or disk) is encrypted.

@PaŭloEbermann: I'm no encryption specialist, just an interested user, but how about this: a group can have a key pair just like any user. And a user can have multiple key pairs in their key ring, so e.g. their own and group key pairs. The group folder can then be encrypted with/for the group key. Of course, as long as it's encrypted for the private private key, group access won't work.

1) You own only what is in your head.
2) The least secure place you can put things you move out of your head is to a place you do not own (your employer's, for example), followed by one you do own.
3) There are various ways (legal and/or ethical) of compelling you to move things out of your head and into the world, and of compelling you to move things from place you own to places you do not. Knowing them is important.
@buffy's excellent comment refers to 3. Your idea to hide an encrypted container with a password you know is an interesting extraction of #1: the location and password would presumably exist in your head. See #3.

A lot of researchers do not own what is in their head if those ideas came about while they were employeed.

@StrongBad This gets philosophical..And I disagree. How do you justify your statement?

@emma in the UK "An employee who creates intellectual property in the normal course of their duties cannot claim to own that intellectual property" see for Example 2 of someone coming up with the idea in the shower.

Oh, I see what you mean. That example sounds reasonable.. Though, I am not too big a friend of patents, but rather a friend of open access regarding publications (that sounds a bit contradictory in this discussion). But again, there are good strategic reasons in an academic sense to hold back certain ideas or results, e.g. to think things through, or to wait for a conference with a better audience/reputation, etc. Also, there is a lot of pressure in academia, so everyone is expecting

publications. The smaller the progress that is published, the worse the quality. In addition the difference between an idea and a result is not always clear.

@emma why do you respond in a way that sounds convinced that giving your own IT department access to their equipment will magically mean all your brilliant ideas are released to the public and everyone will see them.  It sounds like you are just self-justifying your predetermined stance and refuse to accept that it has no basis in the academic side

@user-2147482637 I did not mean to sound like that, and 95% of my ideas are total rubbish. But I have experienced something along these lines before. My former master thesis advisor who was a PhD student back then has taken my ideas and without mentioning where they came from published them in his thesis (I have never expected him to say these ideas were solely mine, but at least that they emerged

to us while working on my master thesis..) - although he usually is someone very nitpicky about this. He and I are still at the institute, both one step higher on the academic ladder, and for a while this seemed to repeat..

Talk to your works committee ("Betriebsrat"). They should know what you are legally obligated to and what not. And they are not the voice of your employer (the university) but the employees.
Most of what you ask depends on the IT policy relevant to your institute. In general, if not prohibited by institute policies, you are allowed to have private data on your work machine. You maybe also allowed to use Internet access for private purposes. This is also the agreement at our institute, and any access to an employee computer by a third party (any colleague, boss, IT, the institute director) without them being present must be supervised by an employee representative to make sure that only work-related documents (and e-mails) are accessed. And it is suggested that we keep any personal documents in a clearly marked folder (e.g., "private").
Concerning the encryption key: Any work communication must be accessible by your employer for legal reasons! Concerning key escrow, again, ask your  works committee.

Morally, how would I best act in this situation?
  Should I hand over a wrong (digital) private key

Morally it is not okay to deliberately produce a fraudulent work

My computer is owned by the institute, ... and I have completely installed and configured it to my liking.

Then you're tech enough for this:
Get a low cost cloud computer for your personal stuff (Azure, AWS, etc.)
Remote into that computer through the university computer and you can do/store whatever you like (encrypted + anonymous).
Or even remote through your smart phone (if you buy one).
This is  completely portable.
It completely complies with your university's policy
Also you'll never have the heartache and/or expense of trying to get data off of a computer that has been stolen, dropped on edge because a rogue firework was coming at you, was run over, caught fire, etc.
Implement this, and you can give them the private key they've asked for
(more work if you have reused this private key... but that's on you).

It is also a failing of every person with technical ability to not have (work) stuff backed up where others can get to it.
That's my opinion, but it is widely shared in 2020.
For completeness I'll mention that getting a smart phone would make your life easier.
Since you are tech savvy I'll assume this option isn't appealing to you for some reason (and there are a few good reasons).

I never thought about this.  Good answer!   Just as a side note, because I am never clear about that, how much would a minimal use of such cloud use cost per month?

@Mugé Just look around, the pricing may depend on your location. It will depend on what you want to connect to (and whether that is automatically patched). I have used Azure, HostGator, and DigitalOcean. Azure is cheap if you turn it off when not in use - check to see if you qualify for a monthly credit - not the least expensive if you leave it always on (I didn't). There may also be services that offer 'remoting only' on a bare bones machine that are cheaper than what I've mentioned.

FYI: I currently use HostGator for my personal stuff... but it has been a couple years since I shopped around. I supplement with Azure machines (can be done by the hour like DigitalOcean) when I need something that is either more powerful or for one-off use/testing. I'm a developer, you may not desire the same type of options. Some of the privacy plays currently offered (I'm thinking of Norton) only direct your browsing through anonimising services - you're still using the 'work pc' which doesn't work for the original poster (OP).

My computer is owned by the institute

Well then, you have to follow the policies of the institute, whatever those might be.  If you don't like those policies, then give them back their computer and do all of your work on your own personal device.
Think about it from the institute's point of view.  You are probably working on a research project that is being funded from somewhere.  Maybe the government gave your institute a 10 million Euro grant for example.  It is very important to the institute that they show the government that they did something useful with the money so that they can get the next 10 million Euro grant.  Imagine that you get hit by a bus.  If nobody can get your data, then they have to go tell the government, "sorry, all the data we generated with that 10 million Euro grant is on this one computer and we don't have the password, may we please have another 10 million Euros to start over?" That will make the institute look extremely bad. So they have this policy that everyone must make their data accessible just in case.

Instead of rebelling, I am thinking to give access to part of the
  system only, i.e., put certain data in an encrypted container that
  they cannot access?

This seems a reasonable compromise to me.  Make sure your research data is accessible and encrypt the private stuff.

This answer is oblivious to german labor and privacy laws.

Well, I cannot remember signing any policies that said I need to give out my private encryption key. @lalala can you be more specific, please?

@lalala The relevant law here is that the work he is paid to do does not belong to him but rather to the institute. Hence the institute has a right to access it. The privacy laws say they can't force him to reveal his personal stuff. They don't, he is free to move his personal stuff on his personal IT before giving them access to the computer they own. The privacy laws don't say he has a right to have private things on institute property that the institute can't see, that is not how privacy laws work.

@quarague, if you have some knowledge of German law and university practice there, perhaps you should make a formal answer and lay it out. Much of what is here completely ignores that context and seeks an ideal that doesn't exist.

@lalala I will admit that I am not a German lawyer.  But perhaps you can elaborate on how you would have answered the question?  What specifically about my answer do you think is wrong?

-1 for sanctifying ownership of property. If the policies are inappropriate in term of the institute's own goals, or oppressive or harmful to OP personally, their legitimacy - ethically and perhaps legally - is not a given.

"If you don't like those policies, then give them back their computer and do all of your work on your own personal device." That's a backwards step. Because now they will insist on full access to your personal device, plus you're using your own equipment for somebody else's work.

Since the computer belongs to the university, you will need to think in terms of the following limitations.  Even if you bring your own laptop to work to do your private emailing, etc., many work places today, will not allow you to use their network for private matters.
I am surprised to read you have configured your computer to your liking.  As to why, this means your workplace/ academia setup is open to intruders.  As an IT professional, even I when I use my computer, I do not use the administrator screens.  I assign myself like a guest screen and password protect the Admin site, because, even if you do not see it visibly, stuff can download itself on your computer and through your network, spread to other computers.  Workplaces today, will not allow you to download stuff. The IT professionals will do it within academia policies.
Secondly, although everyone else may check their private email at work, we all do, but some work places will not allow you to use your work computer for private matters.  It will be shut off to 'private stuff' as it not only can cause a security issue, but also loss of work hours.  Just saying.
Third, let's say, you do not have good intentions and use the university network to hack places.  You will not be identified unless you log in to some system that records who you are and when you are logged in and your activities.
I am sorry to say, I don't get how your university can allow such lose practices, especially in our era.  Wow!  AND you are trying to hold on to your work computer as if it is your own.

We built and ran our own website as researchers at University - external to IT control and it was signed off by all parties. Mind you they came to us for Unix help at the time so that probably had something to do with it - if they had blocked our website they might have lost our help... IT should remember that it is a SERVICE industry...

I should probably mention that my institute is close enough to the computer science faculty that 90+% of my colleges (including me) are deep into linux, encryption, and privacy. We have technical staff that would configure the computers and/or assist, and also an administrative IT department for the whole university for this kind of support.

Yet, due to the high technical level we are given the option to install linux by  ourselves (for Windows there are different rules). And yeah, I don't use sudo if not necessary (goes without saying). The university has more or less strict rules how to use the network - I believe they are similar to the rules at other universities. And I am allowed to use my personal laptop for personal stuff at the university network according to these rules.

@SolarMike Sorry, I don't understand what you mean.  The university does give students or personnel space to build their own websites as long as it is not commercial.  Generally speaking.  However, even if you are at the library, you have to log in to university system with your credentials, so no funny business is happening or least they can catch you if there is.  Impressive you can help the IT people.  Again, don't you log in somewhere when you do stuff?

I should also add the following situation: Let's say I want to participate at a conference. I do have to pay the conference fee with my private bank account first, and just after the conference I would get the money refunded. So occasionally I need to transfer money through my private bank account which is one of the reasons I have an (encrypted) password database with my bank login on my work computer. Is accessing my private bank at work times for this purpose a private act or a professional act?

Oh and also my computer is connected with a static IP address, so I am responsible for what happens via this IP address. For private computers connected through the university network, they login via personal credentials, so here too, they are in charge of what happens. But all of this is a bit off-topic, really.

@emma I know in Germany the banking system is not like in Canada.  If I understood correctly, your bank login screen is on your desktop or computer but you still need a password for it and bank no. for example.  Of course you shouldn't give out your private password.  My point is that staff / your supervisor (whoever is assigned) should be able to access your computer at your absence.  Change your password that is ok for your colleague/boss to use.  You don't have to keep your own personal password in there.  We were given passwords by IT personnel.  We couldn't even choose our own.

@Mugé Our IT gives the first password, used for the initial setup of the account, then we are required, and IT forces, us to change the password the very first time we log in. IT can then force a change to the password whenever they wish but don't use ours. Not being able to choose your own password, as long as it has a capital letter a number etc etc seems to be a bit draconian or from the stoneage...

@Mugé This sounds horrible: We have very strict rules to change the initial password given out by the university as quick as possible. This means there is always someone knowing you password. Anyway, my point was not to give out my banking password. It was about the separation of private and professional data.

@SolarMike Draconian or not, our supervisor needed access to our research computers. The IT can access anything anyway.  They can even see what you are chatting in private once you are target and your boss wants to know what you are doing, they will hand out your activity.

@Mugé I once wrote a message directly to a colleague's screen - they had been ignoring emails. IT could not figure out what I had done... and I was not telling them :)

@emma don't use your private password regardless.  Do not put private pictures in your work computer, just don't.  Make it a habit.  As for music listening, I wouldn't know about your university policies if they'd allow you to download music files. If you want to listen to music, what is most commonly done is people download music to their iPhones or handy and listen with earplugs.

@SolarMike lol yet, that is funny.  I wish I'd be a network wiz.

You're making an invalid security assumption. When people get handed laptops, take them home, make personal use of them etc. - it is unreasonable to believe those systems are non-compromised. They are simply part of "the outside" vis-a-vis systems that need to be secured. The institute/university needs to try secure less places. And I'm not just stating my opinion here - I've worked in several places where this is the approach.

@einpoklum You are right when you bring up the security issues of all the derivatives of preventive measures and the university, as an institution, needing to be free enough for invention.  I understand that.  However, configuring your work computer yourself, without any limitation, by using university network freely, is an open door to disaster.  Having worked at the university and hospitals, none would allow you to use their network freely.  If someone wants to test beyond limits, they can do it on their own turf.  After all, the institution would be responsible for any damage.

@einpoklum I get traffic from universities and colleges on my website.  Some are good traffic.   I am fine when anybody wants to study my codes, downloads some of the stuff or wants to see how I do things.  However, I do also get not so friendly traffic occasionally from college students.  As we get hit by damage causing behaviour, it is just so that more and more preventive measures are taken.  If we like it or not.

This answer is completely irrelevant in the German legal framework: private use of work computers within reason is protected by law, so your assertion that you mustn't do so is simply baseless.

@KonradRudolph Thank you for your input.  I am aware how Germany functions in terms of computer use and how far they are when it comes to implementing the latest.  I will say, invention is amazing.  There is a lot out there when it comes to open source, and so on, but the general use of information technology is pretty low grade.  The application of such technologies is very slow in process.  So it might be that you are more trusting like we were in the 90s.  Otherwise I will suggest, my answer is something to think about.  Also read some of the answers in between the comments down here.

You are right to be concerned. Private keys are called private for a reason.
The institute also has a legitimate concern, that they won't be able to access the data if you're unavailable. Problem is that when you hand over the key, someone will be able to impersonate you. You don't have to be especially important to be impersonated; if you have a credit card you're a target already. The meta-threat is that, just like with credit card info, if you give it out you may have a difficult time dealing with a future breach, because you're the one who gave out the data.
Solution:
Key escrow: Speak to your IT department about setting up a key escrow. It's possible they're already doing that but I doubt it, because they asked for the key in plaintext. So, ask the IT department and get some technical documentation from them with the details of the scheme. This is not so much to get the details, but to signal to them this is how you expect this to be done.
Automated Backups: Exactly what it sounds like. Backup your ~/project directory, have IT validate the solution. Or, use a shared workspace (ie a git repository).
Separate Keys You might ask the uni to supply you with a public key into which all work-related emails can be BCC'd. This way they get the data and your key is not compromised.

It is not 1990's anymore and both Internet access and personal digital devices are not that much scarse. Back then, it was normal or even expected for an employer to allow some personal use of computers and internet access. And the Internet was a lot safer place, back then.
Now, there is still some acceptance of this practice and even some expectation of privacy regarding personal matters, but the general trend is exactly the opposite. Private matters are private and done on private devices (laptop, tablet, phone), work is work and is kept separate on a work computer.
There can always be matters of competition between different employees (esp. in research or marketing) that have to be kept secret or data that is part of your work, but you are personaly responsible for keeping it safe. Spare for these (and they can be kept in a separate encrypted container) the employer is pretty much in a position to tell you what to do and what not to do, with any computer, or any other tool, or any work-related data.
What's more, your employer is probably responsible for a lot of things related to "your" computer (say, unlicensed or malicious software). When employees are left on their own to manage their computers, it is only because of the brave assumption that they know what they are doing. Today, this assumption is almost always wrong (hey, it is even wrong for most of the IT people I know, but that's completely another matter).
In short, the best strategy is to segregate personal (or, at least, sensitive personal) matters to different device. It may as well be an external USB flash or disk that connects to the work computer when needed or a completely separate device (laptop or tablet). Then, comply to whatever management asks regarding your work computer - be it decryption or "key escrow".
p.s. regarding these matters, student is the same as employee.

Since I am no lawyer or remotely active in that space, so I'll refrain from answering the first question.
Then in general I am a huge advocate of honesty. It's your best bet, anytime, at least in the long term. Therefore I think that handing over a wrong key is waiting for a conflict to happen. And hiding a container might not even be necessary in the first place.
However I do sympathize strongly with the feeling of privacy. I had similar concerns and issues before. To be clear: I do think it is a bad idea to share authentication credentials in general. So the question remains: how to comply with the policy and keep your private data private.
And a few possible solutions come to mind:

Shared repositories / backups for the work related data.

Pro: no need to break into your device at any time. Kind of convenient in general. What if the hardware fails completely? (Struck by lightning.)
Con: you will be responsible to keep this in sync.

An encrypted container solution (E.g.: Veracrypt) No need to hide it really.

Pro: Very convenient for files and backup of private keypairs.
Con: Might not integrate very well with mail configuration and such.

Use an external drive with an automatic mount to keep the container on.

Pro: Physically separates the data.
Con: Might not cover all use cases. (E.g.: the mail configuration) And could be a bit cumbersome.

You could use a security key (E.g.: Yubikey, but have your pick, plety exist.)

Pro: It's hardware, the one holding the key can log in. You don't need to hand them a password or decryption key, but you could get in writing that if you get in a coma (hopefully not!) the can get access to the key.
Con: If you lose the key, you're also out.

Use your own hardware.

Pro: You can have it just the way you like, and there is nothing they can say about it.
Con: It could be expensive. And if data loss is the underlying problem, you haven't solved it.

In the end I think the institute's end goal (having access to the research data?) is very reasonable and justified. But maybe there are better solutions to be suggested to solve the problem. So maybe your strategy could be to find out what their biggest fear is. If it is data loss, clearly there are way better solutions to this, and maybe they are willing to listen for other solutions.

First of all, if IT is correctly managed, your private data may very well already be available because they are backed up.
Then, the ability to have private data on your device is dependent on the local law. You can have the case where everything belongs to the company/school, up to the case where you have the right to have personal data and they are legally protected.
For the first case, you are deliberately working against your institution by defending them access. It does not matter what you think, how they handle their data is their decision.
In the second case it gets more complicated. There is the part where you actively work against your institution like above - for the portion which belongs to the institution (because I guess there is something which belongs to them, right?). You must not encrypt that part.
If you have legally personal data then you can do whatever you want with them and your institution would not access them anyway (again, if this is the legal framework). The complicated part is email, when personal and professional data is mixed.

This is wrong! The human subjects data I collect is owned by the university, but according to the IRB they do not have the right to see that data. In fact the IRB tells me I must encrypt the data. IT then backs up that encrypted data onto their system, but they do not have the key.

@StrongBad: what is wrong? Of course you can have zillion of specific cases, from personal data to military technology. What does it have to do with the generic question, and my generic answer? If you have a specific case, other cases are not incorrect by definition.

First sentence suggests that backed up data must be unencrypted, which is almost comically wrong. The "first case" suggests that if the university owns the data that they get unfettered access, which I pointed out is not generally true. You say you must not encrypt the data that belongs to them, while I point out there is a whole class of data that must be encrypted.

@StrongBad If you have full disk encryption, the backup will be encrypted (except very exotic cases where you backup raw partitions). I am not sure what is comical in that, you may want to check with actual IT. The first case is by far the most typical one - you may be in a different one. I am not sure how many systems you have supervised but if this is not in hundred of thousands over a few huge companies then we probably have a different view of the word "most".

@StrongBad And then comes the last part where the institution decides what to do with their data - you may be in a special case where YOU decide about THEIR data but this is far from being typical.


text:
What are considered as appropriate mean/median grades for college-level calculus and linear algebra in United States (out of 100 or out of 4.0)?
What are considered appropriate mean/median grades for college-level calculus and linear algebra classes in United States (say out of 100 or out of 4.0)?
Please don't just say "it is different with different universities and colleges". Can anyone give me any specific examples where only a particular range of mean/median grade is allowed (or considered reasonable) in some U.S. university?
I am asking about this from the view of instructors/professors. I am not asking what kind of grade is considered "appropriate" as an undergraduate student. This question also aims at giving instructors an idea how to write exams and how to "curve" the scores in case the exams get too hard.

Since course level grades are typically assigned on an A/B/C/D/F basis rather than as a percentage and different instructors use different rules for converting raw grades into letter grades, you might want to focus your question on the distributions of letter grades.  There are published reports on grading at different universities that show that these distributions can vary wildly between and within universities, so I'm afraid that the answer really does depend on specific circumstances.

@BrianBorchers I am only asking about some examples for reference, say in MIT, XXX state university and the University of XXX.  A/B/C/D/F are integers 4/3/2/1/0 in terms of GPA but I suppose in terms of average grade one still wants XX/100 or X.XX/4.00 as estimates.

My experience, not in math, is that grade distributions are bimodal.  An old and experienced professor told me, tapping the hump with the higher grades, "these students get it" and, tapping the other hump, "these students don't."

Hmmm. It's different with different universities and colleges. What can I say? It is also meaningless except with that university or college. And unusual system may need translation for external use, however.
A typical (not universal) grade scheme is 90, 80, 70, 60 for the minimum marks for A, B, C, and D respectively. However, grading is itself individualized so the grades often are awarded to meet those breaks. How well has the student mastered this material. "Near perfect" = 90-something. "Almost" yields 80 or so. Etc.
And numeric grades within a course are usually fractional. 3.8 is not as good as 4.1, but only by a little. For the transcript, though, they might be integers only or "half" scores: 3.5, sometimes with a max of 4.5. The overall will be a fractional GPA: 3.7 or 3.72, say.
Note that the grade distribution for a class is likely to be different for entry level (first year) courses and for later (upper division) ones. The less serious students have likely gone elsewhere. If the same "curve" applies then it is almost certainly unfair. A lower mean and a larger variance is likely for an entry level course, especially if it has many students.
I've taught courses at a top university where nearly every student earned and deserved 90 plus. They worked hard and made me work hard as well. I've also taught courses where students had been accustomed to be a bit lazy and were a bit shocked with their low grades. It was, fortunately, a convincing goad to get them to work harder.
Every group is different, not just every university. A group of 400 or so students might have something like a normal distribution of grades (honestly and fairly) but a group of 40 isn't likely to. It is too small. Probably skewed one way or the other as in the two examples above.
Note that large groups with many sections and lots of TAs need to take some precautions to assure that grades are fair across sections and TAs.
My advice is to make grading individualized but using a rubric. Consider every student to be different from every other with their own strengths and weaknesses.
And if you impose a grading scheme such that some student has to get low marks so that others can get higher marks (competitive grading) then IMO you are being unethical.
Your job is to teach them. I.e. set up the conditions for learning. It isn't primarily to grade them. You aren't the Hogwarts sorting hat.
At the end of a course, do an informal evaluation of your grades prior to filling out grading forms. You probably have a general impression about how they did "overall". If your grade distribution matches that general sense, then you probably got it about right. I had the luxury of being able to adjust grades upwards (for all) if I felt the individual grades were too low for what I saw as the learning. Never downwards, though. Surprises for students should be happy ones. This ability to adjust depends on some experience, of course.
See this post about imposed curves.

There are few cases where this information would be useful -- it varies widely from school to school. The only case that I can think of where you would want this is if you are a faculty member at a school where there is a political fight about what the grade distribution should be, and you would like to introduce data of the form "at U Michigan, the median grade is a B" into the discussion.
That said, I know where to look up this data at UMich, so here it is: The grade distribution for Math 115, our largest calculus course:

Unfortunately, this data is behind a log in screen (see here), but there aren't any FERPA issues with large statistical reports like this.
I would like to editorialize on people's sad inclination to put passwords on things. At Harvard, this information was collected in the CUE guide, which was sold in campus bookstores where anyone could walk in and buy it without ID. Now it is online, which make perfect sense -- but you need Harvard log in credentials to read it. Why??!!

Working at a university that also puts the most random stuff on the Intranet (rather than the public website) I often wonder the same thing. Especially since everybody is aware that material that's available to thousands of people, some of which are only loosely associated with your org, is effectively public anyway.

Thank you so much for your data. This is very helpful!

@NoOne If this is a serious research project of yours, I would suggest (1) writing to a bunch of universities to explain what data you want and why. (At that point, you probably need IRB approval.) (2) For state schools, I would think you could get this data by FOIA, although that is obviously a big job.

I will assume you are referring to the distribution of letter grades, and that your university does not have a mandatory mapping from "points" to letter grades.
There are two different philosophies here:

One is that the course should challenge the average student. So an average student should get a B (or somewhere between a C+ and a B+), with most of the rest getting As or Cs. If the average course grade is much higher or lower than this, then it's probably the case that the course was too hard or too easy, relative to the college's admissions requirements.
The other is that course grades should honestly assess a student's familiarity with the material. Even at an "easy" college, students who get an A in calculus 1 should be able to reliably take a derivative and tell you what it means. If this means that you give very few As, that's just the way it goes; better that they fail your class rather than moving on to physics classes where they have no chance of succeeding.

Of course, in both cases, it's "theoretically possible" that all students will exceed all reasonable expectations and thus they'll all deserve As....but this is statistically very unlikely.
In the US, my experience is that the first philosophy is much more common. For most (STEM) courses, I would expect average grades somewhere between 2.7 and 3.3 out of 4. But you asked about calculus courses specifically, which may be one of the rare cases where the second philosophy is not so unusual, and a relatively large number of failures is expected. Of course, this will vary by school:  MIT undergraduates will probably not struggle too much with calculus. But in general, I would not not be so concerned if the mean Calculus I grade was even lower than 2.7.

source: Stack Exchange

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

sort: votes