By Maddi Miller and Riley Sine
An email containing an attachment with students’ personal and academic information was accidentally sent out to the graduating class on Monday, Jan. 22.
The attachment, an Excel spreadsheet with multiple tabs, was meant to be a ballot for selecting the student speakers at this spring’s Baccalaureate and Commencement ceremonies in May. However, the file contained 10 tabs, with titles such as “SP18FERPA,” “MasterList,” and “FA17 GPA.”
These tabs included directory and academic information such as GPAs, student identification numbers, programs and majors, credits attempted and earned, and whether a student has signed a Family Educational Rights and Privacy Act (FERPA) nondisclosure form, for almost every student who took classes at NU during the Fall 2017 semester. More detailed information could be found for some groups of students, such as home addresses and whether a graduating senior still owed tuition money to the university. Faculty received a similar email containing only the ballot tab of the spreadsheet.
Assistant Registrar Sharon Jones sent out an apology email that afternoon and attached the correct ballot to that email.
“The email did not include DOB [date of birth] or SS# [Social Security Number] information, so your personal identifiers were in no way compromised. However, the information was not for public distribution; and for that, I deeply apologize,” Jones said in the email.
In an email to students, Provost Dr. Jim Heugel apologized for the mistake on behalf of the university, and asked students who received the email to delete the file.
“We all make mistakes, but a mistake of this type is embarrassing for the University to have made and we deeply regret it. We have taken measures to double check in the future to make sure this doesn’t happen again,” Heugel said in the email.
The information is designated in Northwest University’s FERPA Student Records Policy as “directory information,” which is not to be disclosed without written consent of the student, with some exceptions, such as faculty and staff. For students who have signed a FERPA nondisclosure form with the university, however, this email to students constitutes a violation of that policy. The email also identifies theses students as having signed such a form.
“[The disclosure of the file’s contents to students] is a FERPA violation,” Heugel said, adding that students may file an official complaint if they desire.
Students and faculty said they were caught off-guard by the email and the information it contained.
“I was initially confused, because I assumed the email was the one to faculty,” Dr. Clint Bryan said, “and then I learned the fact, from students who reported to me, that it had actually gone out to students, and I’ll have to admit I was a bit taken aback, just because it seemed like an unfortunate incident.”
According to the U.S. Department of Education, FERPA regulations dictate how students’ information is to be protected and shared at any school or university which receives federal funding. This includes most colleges and universities, from public institutions like the University of Washington or Western Washington University, to private schools like Northwest or Seattle Pacific University.
“Under FERPA, a school may not generally disclose personally identifiable information from an eligible student’s education records to a third party unless the eligible student has provided written consent,” according to the Department of Education’s website.
Heugel said that the Registrar’s office, when compiling lists such as the Baccalaureate ballot, often needs to have multiple data lists open in an Excel file so that they can use various formulas to pull together the information they are looking for. Under normal circumstances, he said, only the final tab is what gets sent out, but that is not what happened this time. In the future, he said, the Registrar’s office will instead make a PDF of that first tab and send that out in emails, rather than the entire Excel file.
“We should never send a whole Excel file to a group of people. We need to convert that one tab into a PDF and send that, and that can be the solution going forward and make [it] a rule that you never send a file, only a PDF,” Heugel said.