Slashdot Mirror
Challenges to Opt-Out Privacy Policies at Colleges?
jmaxlow asks: "It's that time of year again when my university sends out mailers informing students that their personal information will be compiled and released in a student directory unless students register objections in writing by the deadline. This info includes name, address, date of birth, and email address, among other items, and there is nothing to prevent them from selling the information to third parties without vested interests. The Buckley Amendment allows them to do this, so of course it isn't illegal. But my question is: has anyone ever petitioned their university to change to an opt-in policy? I'd like to know what responses schools have given, if any, when challenged, before I bring it up with my own registrar."
Opt in? You mean, "Please, PLEASE sell my personal information to the highest bidder! Please make a profit at my expense, without any possible benefit to me!"
Generally, "Opt-in" services are where you pay someone to provide you a service. "Opt-out" is where you bitch at them to stop charging you, or raping and pillaging you, or whatever. I can't see any possible benefit to an "Opt-in" service of this type, unless you are a masochist.
I am alone, yet I also surf the universal backwash of undifferentiated Being, which is LOVE.
Obviously, there has to be a distinction made between the *kinds* of use of your information.
For instance, I would *want* all of my personal information to be in the student directory, so friends of mine at the school would be able to contact me easily. On the other hand, I would *not* want any of that information to fall into the hands of companies trying to target the student market.
I do recall that starting sophomore year or thereabouts, my school stopped listing the extension numbers of students living on campus. This mean that if you wanted to find out the phone number of a fellow student living on campus, you had to trudge over to the main office, show your student id, and then ask (no, they would not give the information over the phone!). This was very annoying, though it was clearly thought necessary to protect the privacy of the students, especially women.
Nevertheless, we still had a few obscene crank callers that got a hold of some of the numbers anyhow...
Karma: Chevy Kavalierma.
Here (Canada, so obviously different laws apply), my Uni does collect that info, if only to send us the necessary things to attend classes (registration, etc.). I don't recall anything about selling those informations to other entities though.
The students of my faculty do have a student directory. The old way of getting the info was by passing sheets in each class, where people could modify their current information at the beginning of the semester. So if you didn't want to be listed, you just didn't filled it (opt-in). Now, that has changed a bit: the info for the directory is channeled from the Uni's info to the paper directory. But again, sheets are passed at the beginning of each semester to get the approbation of students to be listed in the directory.
To get back closer to the subject, I recall that some insurance company was sponsoring an event for coop students, so they had to send a letter to each of them. The way it was handled was that the insurance company gave us what they wanted us (the student's association) to send, and we handled the "put it in an envelope, put the address sticker and repeat" part. They never had access to the list of students, or to their info.
Denying these customary information releases for a few privacy fanatics isn't in the interest of a college or its students. On the other hand, the process of restricting and unrestricting one's directory information should be made as frictionless as possible. And in an ideal world, schools wouldn't sell out their students to marketers for chump change.
Unfortunately, changing this type of service to opt-in would render the service completely useless. Very few students would both registering for the service, unless it was absolutely necessary. Being a recently graduated student, now working in a University IT department, I have seen the student apathy levels from both sides. If purely voluntary opt-in, only a small percent would bother.
However, I agree with Opt-In policies for all identity information repositories. So the real question becomes -- should this service be offered at all? DO most students want their information shared? DO they understand the risks? Should they? Should such repositories allow only authenticated access, no public access?
Thoughts?
10b||~10b -- aah, what a question!
An opt-in policy will result in better privacy, but is it practical? The aim of the whole thing is to create a rather complete directory. If you consider how many student are too lazy to answer and don't care about whether they're included or not, an "opt-in directory" will probably only contain a very small percentage of the students. Opt-out, on the other hand, just removes the ones who are really concerned about their privacy, for the price of a little work on their side, resulting in a directory as complete as possible.
The best way is probably to release only the name under an opt-out policy and provide students with an automated interface to allow or disallow a choice of other information to be listed. Then offer enquirers an automated option to ask for more information: Student get's an email notification and can grant or deny permission through a webinterface. That should satisfy both the completely paranoid and the database fetishists.
Just a friendly public service reminder for those of you in the USA:
When your bank or brokerage sends you a copy of its privacy policy, full of ambiguous language, and saying "Since we protect your privacy, there's no need for you to opt out of our information sharing among our family of companies", do two things:
1) Opt-out. Yes, it means writing a letter and putting a stamp on it. Deal with it.
2) In your letter, mention that you're opting-out because it's your only option available under the law, but that you're doing so under protest - and that you consider anything less than opt-in a violation of your privacy rights. Congratulate the bank on coming up with a wording ("information sharing") that sounds so harmless that most consumers are unlikely to realize what it really means.
3) Print out a second copy and send it to your Representative and Senator. Use proper "Cc:" snail-mail etiquette -- you want your bank to know you're telling your Congresscritter, and you want your Congresscritter to know that your bank knows.
Thank the critter (especially if he or she voted for it) for the new privacy law that's forced banks to do this very small ("opt-out") notification. Tell them that you realize the bank (or more accurately, the DMA, on request of its members) to use a low response rate to this "you have an opportunity to opt-out" mailing campaign as "evidence" that the consumers really do like to eat their spam, "or they'd opt-out, but since 0.00001% actually bothered to opt-out, the other 99.99999% must like receiving special offers through the mail and telephone and email!".
Tell your congresscritters that silence does not imply assent.
You know the argument's bogus. But the DMA, with millions of dollars in lobby funds, is gonna try to make it. And they'll succeed, unless you - yes, you there, behind the keyboard - get off your ass and do something.
Silence does not imply assent. But the DMA is going to try very hard to convince your congresscritter that it does.
The logical response is to deny the DMA the silence it needs to pull off the scam.
I live in a giant bucket.
Secondly, your university is most likely a non-profit organization, which grants it certain tax benefits. I believe selling student data to marketing droids would challenge the university's non-profit status, which means big bucks. You should look into this because the university's non-profit status determines a lot of policy decisions.
Maybe you haven't been to a university, uh, ever? But colleges function as one hell of a money-making institution. As if state and federal grants, tuition, and student fees don't more than adequately cover costs, they then pull in sometimes insane amounts of alumni donations and other contributions.
Try some research.
Regards,
levine
Buckley (Also know as FERPA) requires american educational institutions (all, not just post-secondary) to protect ALL student information from disclosure, with certain exceptions. The exceptions include inquiries from government agencies and other educational institutions (i.e. they can reply to another university when they call to check your transcript). This is OK mostly becasue these institutions have the same sorts of restrictions placed on them once they have the info.
The other big exception is for "directory" information. What comprises this information is up to the discretion of the university. You would think what sirectory info was would be obvious, or at least standard, but at least at the university I work at, a leading online university, does not count email address as directory information (because otherwise other online universities (read "for-profit") might be able to request, and we'd be required to provide, this information, and then PU spam is just a click away).
There was recently a story in the news of an elementary school in Texas somewhere who was publishing student info in this way. They were just following the letter and spirit of the law.
So opt out. Your school is following the law. If they put you in a student directory, then they have to give that info to anyone who asks.
Maybe they could publish a student directory with everyone assigned a code number, which you could then input to a student-restricted website to get the address of that hottie you've been wanting to stalk?
I work for a college and I asked why was a union allowed to have my address and was basically told that because I work for a state/public school, that my address is public information and they have to give it to anyone that asks. I was infuriated (plus I am against this union in representing ME!). I don't give a rats ass what kind of institution I work for the better limit acess to my info to only the institution.
That said, for the students, this kind of selling could be against the FERPA law. Family Education Rights and Privacy Act should prevent this kind of selling of student information. If it doesn't, why doesn't it? I remember when I was setting up a printer in the Records and Registration area and things are so tight with FERPA that they have to have to separate 75 page per minute printers (or ones similar to it). One prints schedules and the other is the only one they use for transcripts because the one for schedules anyone can get to including other students. The address could be considered different then say evidence that you took a certain course, but I don't think it should be that way.
Gorkman
when i was at ohio state, we had a similar database of email addresses, phone numbers and regular addresses. i found it to be very usefull for getting in contact with profs, ta's and other students about school projects. that use alone outweighs the slight inconvenience of a little more junk.
the list started out as a gopher and ph service, but now it is more accessible through a web form:
http://www.osu.edu/cgi-bin/Inquiry
We didn't have a name/phone number/address one, and the administration wanted to create one, and while I was in our Residence Hall Association, I worked strongly against it.
Student stalking by other students is really pretty frequent, and this is a major concern among lots of females. If you knew what building someone lived in, you could call the front desk 24/7 and get connected to their roo. This also allowed the front desk to screen potentially harmful callers (ie someone from the room could request no calls be connected.)
My own view is that if someone should have your number, you can give it to them. We also had a student accesible email directory, which I had a lot less of a problem with. It was a fairly safe way for someone to be contacted, and if someone you don't like is emailing you, it's very easy to filter out, or bring to the OIT.
WALDO
maxlow asks: "It's that time of year again when my university sends out mailers informing students that their personal information
will be compiled and released in a student directory unless students register objections in writing by the deadline. This info
includes name, address, date of birth, and email address, among other items, and there is nothing to prevent them from selling
the information to third parties without vested interests. The Buckley Amendment allows them to do this, so of course it isn't illegal. But my question
is: has anyone ever petitioned their university to change to an opt-in policy? I'd like to know what responses schools have given, if any, when
challenged, before I bring it up with my own registrar."