Privacy breach-what to do?

[niju321]

---

Members do not see this ad.

Hello,
I was wondering if anyone could help me out with what to do about the following situation:

On Friday afternoon one of our academic advisors sent out an email to a couple of dozen students with information on what students would be promoted to the next higher year this June. The email included names, student ID numbers, type of promotion (regular, honors, etc), whether a student was on academic probation, and the GPA and most recent grades of a couple of students close to the knife edge. Approximately 30 minutes later, an attempt was made to recall the email but that didn't do anything. Finally on Friday night all students in my year had their user accounts locked, so we can't login to our email accounts, Blackboard, financial information, anything. I can't even get on my school's wireless network. Apparently an email was sent just before the accounts were locked, to the effect of "we sent out an email that you shouldn't have received, please delete it, contact us if you have any questions." Of course, it being a Friday night I was not there to read this.

What should I do about this? What should I ask them? Any other suggestions?

Thanks for your help!

 

[Blesbok]

Why exactly would you do anything? Ya, it sucks and someone probably going to get seriously reprimanded or fired over it, but what exactly are you going to do about it? Are you going to go beat them with a stick? Are you going to invent a time machine and go back in time and save the day? Seriously, what the hell kind of response do you expect? You sit there and wait while they change your student ID numbers and apologize profusely for letting the rest of the class know that you are failing miserably. This isn't mcdonald's, they aren't going to give you a free A because they screwed up your order.

 

[OncoCaP]

Hello,
I was wondering if anyone could help me out with what to do about the following situation:

On Friday afternoon one of our academic advisors sent out an email to a couple of dozen students with information on what students would be promoted to the next higher year this June. The email included names, student ID numbers, type of promotion (regular, honors, etc), whether a student was on academic probation, and the GPA and most recent grades of a couple of students close to the knife edge. Approximately 30 minutes later, an attempt was made to recall the email but that didn't do anything. Finally on Friday night all students in my year had their user accounts locked, so we can't login to our email accounts, Blackboard, financial information, anything. I can't even get on my school's wireless network. Apparently an email was sent just before the accounts were locked, to the effect of "we sent out an email that you shouldn't have received, please delete it, contact us if you have any questions." Of course, it being a Friday night I was not there to read this.

What should I do about this? What should I ask them? Any other suggestions?

Thanks for your help!

If your school has a habit/pattern of doing this (doesn't seem like it), you can complain and the federal government can withhold funds (which would really hurt YOU and your school). Here is one of the more detailed descriptions I found on the web of what is going on here. Most policies just say you can complain about it and where. This one had some explanation which I have not verified but appears to be reasonable:

http://www.winona.edu/registrar/1482.htm

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student educational records. These same rights are reinforced in Minnesota by several state laws, including the Minnesota Government Data Practices Act. FERPA prohibits the funding of an educational institution that has a practice of disclosing educational records , or the personally identifiable information contained in those records, to unauthorized individuals without consent of the student's parent. When a student turns 18 years old or attends a postsecondary institution at any age, the rights under FERPA transfer from the parent to the student.

...

Penalties For Violating FERPA

Individuals cannot be penalized for FERPA violations, and the U.S. Supreme Court has held that individual students cannot sue for damages under FERPA. However, as noted at the top of this memo, the federal government has the right to deny funding to any educational institution that has a practice of violating FERPA. The government would base its decision in such a case upon evidence that faculty, staff, or administration had an ongoing pattern of making improper disclosures and that the university had made no effective efforts to prevent them. WSU Regulation 3-9 establishes the university's own policy for applying FERPA and, therefore, demonstrates a commitment to complying with the law. Following through on that commitment becomes an obligation on the part of all faculty, staff, and administrators.

However .....

Also note that the Minnesota Government Data Practices Act (MN Statutes 13.01 et seq.) does allow for sanctions against government agencies (like WSU) and individuals who violate data privacy expectations. To quote the statute, "In the case of a willful violation, the political subdivision, statewide system or state agency shall be liable to exemplary damages of not less than $100, nor more than $10,000 for each violation. .... Willful violation of this chapter by any public employee constitutes just cause for suspension without pay or dismissal of the public employee." Unlike FERPA, therefore, the state law provides for --- in fact, requires --- a substantial penalty.

*****

Thus, if this administrator was selling these records or something crazy like that, then that person can be fired. Your state might have similar rules or not.

You're basically out of luck if you were affected by this, since it appears to have been unintentional in a certain sense and they have a process because dealt with it right away, probably have a handbook, etc.

 

[butiwuvu]

What should I do about this? What should I ask them? Any other suggestions?

You should do nothing.

For some reason, everyone today has a "someone screwed up so I deserve something" attitude. This came across in the OP's post, whether intended or not.

It's not a big deal. Someone sent an email that shouldn't have gone out. Who cares. If it was full of credit card numbers, SSNs and stuff like that, then you might be justified in being a little worried. But a student number? That's probably the most undamaging personal information in the world. Think about the untold damage someone could do - they might be able to register you for an art course, and this might take you all of ten seconds to correct with no detrimental effects whatsoever. Oooooh!

Leave it. There can be nothing good that will come from you kicking up a fuss. You won't get anything from it. You'll simply make a name for yourself as a troublemaker. The school is taking care of it by recalling the email etc. The last thing they need is an undergrad fussing about how his student number was compromised and how he's going to sue and how he's going to get a lawyer to look at the situation.

I mean, what on earth do you want the school to do above and beyond what it's already doing? Give you a free semester of tuition? Give you straight As?

Surely you've got something more important going on in your life to worry about?

 

[soeagerun2or]

What should I do about this? What should I ask them? Any other suggestions?

Thanks for your help!

You should ask for records indicating if/when this has previously happened, how widespread this information potentially was released this time, and what safeguards & assurances are in place if your confidential personal information are accessed and used without your approval.

 

[butiwuvu]

You should ask for records indicating if/when this has previously happened, how widespread this information potentially was released this time, and what safeguards & assurances are in place if your confidential personal information are accessed and used without your approval.

Seriously? What a waste of an afternoon.

My first question would be "Is this information damaging in any way whatsoever?" If it is, then perhaps make a little bit of a fuss, but only after giving the school a chance to fix it.

But if the information is not damaging, then there's no harm done. Not all private information is harmful. Who cares if your student number was sent out. Chances are, without a password, it's useless. And chances are, it will be changed by the school already. You mentioned that the email listed who was getting promoted. Again, big deal. It's useless information to everyone else.

You really want to kick up a huge fuss by demanding records of who stuff was sent to and when etc? I just don't see how this would be beneficial whatsoever. And it would make you look like a huge, uptight di*k.

 

[Blesbok]

Seriously? What a waste of an afternoon.

My first question would be "Is this information damaging in any way whatsoever?" If it is, then perhaps make a little bit of a fuss, but only after giving the school a chance to fix it.

But if the information is not damaging, then there's no harm done. Not all private information is harmful. Who cares if your student number was sent out. Chances are, without a password, it's useless. And chances are, it will be changed by the school already. You mentioned that the email listed who was getting promoted. Again, big deal. It's useless information to everyone else.

You really want to kick up a huge fuss by demanding records of who stuff was sent to and when etc? I just don't see how this would be beneficial whatsoever. And it would make you look like a huge, uptight di*k.

Deformation of character. Call Cochran...oh...wait...he's dead...and it isn't deformation of character if it is true.


Does anyone else think it is funny that this person is so concerned? I doubt if he had a 4.0 he would be whining. Chances are this is one of the people that is getting held back and is fully embarrassed that now all his classmates know he is failing.

 

[butiwuvu]

Chances are this is one of the people that is getting held back and is fully embarrassed that now all his classmates know he is failing.

 

[Doctor Bagel]

You should ask for records indicating if/when this has previously happened, how widespread this information potentially was released this time, and what safeguards & assurances are in place if your confidential personal information are accessed and used without your approval.

I agree. The school goofed, and they need to put safeguards in place to make sure it doesn't happen again. Whether or not you receive an apology would also be a good reflection of how concerned your school is.

 

[MattD]

Deformation of character. Call Cochran...oh...wait...he's dead...and it isn't deformation of character if it is true.


Does anyone else think it is funny that this person is so concerned? I doubt if he had a 4.0 he would be whining. Chances are this is one of the people that is getting held back and is fully embarrassed that now all his classmates know he is failing.

how do you deform someone's character? Does it involve a blowtorch and sledgehammer?


And if anyone's failing, it's not going to be a secret for long... people will notice when he's NOT IN THEIR CLASS ANYMORE.....

 

[Occams Razor]

niju321-

Obviously this upset you, so do something about it! Don't be a sheeple nodding along with the flock, no matter what the school's mistakes may entail. Write a letter and address your concerns to the academic adviser, and ask what actions they will take to insure students' privacy. If you are one of the ones effected (borderline GPA or probationary status), briefly explain that you are embarrased, etc by this.

No need to blow it out of proportion by asking for records of who it was sent to, talking about defamation, etc. What's done is done, and the harm of people knowing who is academically in trouble has already been caused.

 

[Blesbok]

how do you deform someone's character? Does it involve a blowtorch and sledgehammer?


And if anyone's failing, it's not going to be a secret for long... people will notice when he's NOT IN THEIR CLASS ANYMORE.....

😳 fam

I blame it on too much board study.

 

[butiwuvu]

Write a letter and address your concerns to the academic adviser, and ask what actions they will take to insure students' privacy.

And then I'm sure that academic advisor will be very happy to return the favor and write you a crappy letter when the time comes...

My advice? Just leave it. It was an accident. No harm was done. They took prompt steps to correct it - within 30 minutes. End of story. You've got bigger battles to fight, so you might as well do everything you can to keep your alliances strong.

 

[Blesbok]

And then I'm sure that academic advisor will be very happy to return the favor and write you a crappy letter when the time comes...

My advice? Just leave it. It was an accident. No harm was done. They took prompt steps to correct it - within 30 minutes. End of story. You've got bigger battles to fight, so you might as well do everything you can to keep your alliances strong.

bingo

Don't piss off the administration, because they do have to write you a dean's letter at some point in the future. It was an honest mistake and there are no time machines to fix it. Let sleeping dogs lie.

 

[Occams Razor]

If one writes a letter respectfully and concisely, it's not going to "piss off" the admin, or sabotage one's future in medical school.

All i can say is this: if there's a problem that i feel needs to be addressed further, i dont hesitate to write to the academic advisors, deans, or presidents if i feel they should be aware of the situation and take more action to rectify it.

 

[Blesbok]

If one writes a letter respectfully and concisely, it's not going to "piss off" the admin, or sabotage one's future in medical school.

All i can say is this: if there's a problem that i feel needs to be addressed further, i dont hesitate to write to the academic advisors, deans, or presidents if i feel they should be aware of the situation and take more action to rectify it.

Yes, but they shutdown the email and I am assuming manually removed the email from all the boxes. I am sure that an apology has either been sent or will be sent. What more could a letter POSSIBLY do?

 

[butiwuvu]

If one writes a letter respectfully and concisely, it's not going to "piss off" the admin

Yes it will. They will take it personally that you - a student - decided to get involved, when the administration is most likely already involved and when the advisor has probably done all that can be done to help the situation already. There is nothing constructive that writing a letter can do. Not even a respectful nice letter. There is no respectful way to call the advisor a mentally deficient ape for sending out a mass email without checking it first.

There are times when it's better to just shut the f**k up, even if you're justified in complaining. This is one of those times.

 

[niju321]

Thanks everyone for all the replies. Yes, the administration sent out an apology to the class saying they goofed, were sorry, reset your password and everything will be fine, etc. The only information I had revealed was my ID number--according to the replies that's not a big deal so I guess my worries were misplaced. My major concern was that I couldn't log in to anything (email, finances, etc) but that is back online as of yesterday. I would agree that there is nothing to gain from making a fuss now, so I suppose I'll sit tight. Thanks for your help.