Student info accidentally leaked

By Natalie Rich /// Senior Staff Writer

At approximately 12:30 on April 1st, 2016, every person who uses a @lclark.edu email address received a bizarre e-mail. A student, it appeared, was withdrawing from an indeterminate number of classes and the e-mail regarding that withdrawal process was mistakenly sent to all students, staff and alumni. An e-mail chain quickly developed and replies ranged from students questioning why they were receiving the e-mail to humorous gifs and memes. A hashtag was even borne out of the experience, as students called for the student to be “free” from the school.  

“I thought it could be an April Fool’s prank…but I liked that the student body showed a lot of support for the student,” Jemma Goddard ’19 said.

However, though many students had fun with the incident, the information about the student that was sent out actually perpetrated a FERPA violation, and it’s not the first time.

FERPA is the Family Education Rights and Privacy Act, passed in 1974. It  ensures a student’s privacy with regards to their academic records. On the Lewis & Clark website, FERPA is listed as one of the Institutional Policies, and one of the pieces of information that LC may never release to the public is a student’s Identification Number. In what is being dubbed as “emailgate,” the student’s ID number was listed next to their name. In addition, LC is not permitted to share correspondences relating to a student requesting actions such as withdrawal, as this student was.

The Bark sent out an apology for the incident, and offered LC IT’s explanation for how it happened:

“The withdrawal-process Google Group is used to inform the various student support offices around campus when a student is expressing a desire to withdraw,” the statement said. “One office completes a form that initiates an email that is sent to the other offices. This sharing of information streamlines the process for the student. While updating the membership of this Google Group last month, an erroneous character was accidentally added as a user. When the withdrawal process was used earlier today, this mistaken character translated to email being sent to everyone with an @lclark.edu address.  People were confused when they received the e-mail, which then resulted in a flurry of replies to all.”

David Ellis, Vice President, Secretary and General Counsel for the Office of General Counsel for LC, confirmed via email that the student was informed quickly of the incident.

“The College apologized for the mistake and any inconvenience it may have caused,” Ellis said. “User error is impossible to prevent entirely.  However, IT continues to work with departments who wish to automate work-flows to help them avoid these types of errors, and is working with Google to see if there are technical fixes to help prevent user error.”

A similar incident occurred last spring, wherein an e-mail to a student’s parents regarding unspecified issues that would result in the student being removed from his or her residence hall was sent to the entire student body, staff, and alumni. Though this did not mention the student’s ID number or other sensitive information, an e-mail regarding a student’s mental health or personal issues violates their right to privacy as ensured by FERPA. Ironically, the e-mail mentioned the student’s right to privacy, and yet the entire school received this e-mail, thus eliminating any privacy.

Since the e-mails contained private information, Ellis spoke to the rights of the student to take legal action:

“Students who believe that their FERPA rights have been violated have the right to contact the Family Policy Compliance Office at the Department of Education (“FPCO”).  There is no private right of action for students under FERPA…that is, a student does not have the right to sue the College for a violation of FERPA.”

Ellis also added that he wasn’t aware of any recent FPCO complaints from LC students, but mentioned that there had “probably been some in the history of the College.”

Most other students seemed unaffected by the incident, commenting by large that while they vaguely remembered the event, and thought it was funny, they had almost no opinion on it.

On the issue of legal action, Goddard said, “I mean, I guess I would be a little upset if it was me, but mistakes happen.”