Southeast department sends email violating student privacy

On Oct. 4, an email including information from the College of Humanities and Social Sciences leaked private information about students, faculty and staff members to approximately 50 Southeast communication students.

The email was sent with personally identifiable information (PII) to the communication students within the major. The email included three attached excel files, including information such as Southeast ID numbers, GPAs and academic standing, among other personal information.

Information disclosed without a student’s consent is a violation of the Family Education Rights and Privacy Act (FERPA), a federal law dating back to 1974 that protects the privacy of student education records.

According to Sandy Hinkle, university registrar and Southeast’s FERPA administrator, most of the information shared was “directory information” besides GPA and Southeast ID numbers.

Twenty-eight faculty or staff members PII was released in the email due to their role as advisors to students in those majors, according to Hinkle.

“The University takes seriously its obligation to safeguard your information, and we will be immediately providing retraining for University employees to ensure greater attention to detail and better compliance going forward,” Hinkle said in an email to affected employees.

The U.S. Department of Education website defines “directory information” as “information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed.” Given examples of such information include name, address, telephone listing, date and place of birth, as well as participation in officially recognized activities and sports, and dates of attendance.

“Under FERPA, a school may not generally disclose personally identifiable information from an eligible student's education records to a third party unless the eligible student has provided written consent,” the U.S. Department of Education website states.

Senior Eli Bohnert, political science and communication studies double major and former vice president of Student Government Association, said he feels as if the university hasn’t done enough when dealing with this issue.

“I feel as though my privacy has been violated in this email, and the school never did anything to apologize or acknowledge it,” Bohnert said. “Grades and your academic standing should be private information.”

Another communication studies student who wished to remain anonymous said she feels let down and that the overall situation is uncalled for.

“I hope that Southeast can find a positive solution to the problems that have occurred due to their negligence and lack of precautions before this list was sent out,” she said.

Less than a minute after the email was sent, another was sent attempting to recall the original email. However, every student who received the original email already had access to students’ information.

Director of University Communications Ann Hayes stated in an email to the Arrow the email containing the PII was a result of an inadvertent action, and the university will work with the campus FERPA administrator to contact affected students in order to alert them of the incident and address the matter.

Sommer Ingram Dean, the staff attorney for the Student Press Law Center – an organization that aims to protect press freedom rights – said the definition of what falls under an education record has caused some confusion over the years. She said students’ grades will always fall under this category.

“FERPA punishes schools that have a policy or practice of disclosing a student's education records without the permission of the student,” Dean said. “However, a one-time incident would likely not be termed a policy or practice as stated in the law.”