North Texas Daily

Dalton LaFerney / Views & Digital Editor

The College of Business Undergraduate Advising and Student Services Office violated a federal law when it released the records of undergraduate business students in a mass email.

Sensitive details were included in the email that breach the Family Educational Rights and Privacy Act, enacted in 1974. On March 11, an employee of the office, whose name has not yet been revealed, mistakenly attached a master list of 4,430 students’ records to an email sent to 500 students. It is not certain whether or not the staff member remains employed at UNT.

The office realized the error within an hour, and University Information Technology personnel retracted 423 emails before they could be opened. The remaining 77 recipients gained access to records like student ID numbers, GPAs, names, telephone numbers and degree plans. Neither Social Security data nor credit card information leaked.

“This is [a violation] because of the educational information included, particularly the GPA,” UNT spokeswoman Margarita Venegas said. Almost a month following the accidental email, on April 10, the business undergraduate advising office mailed letters to those students whose information was compromised.

The letters, attributed specifically to Desiree Robison, assistant dean of the advising office, detailed the mishap and recommended students take proactive steps to prevent identify theft. It also offered guidance from the business school.

“Understandably, people have been upset,” Robison said, adding that about 150 people have reached out to her office so far. “Once we have answered their questions, told them what had happened, most have been very understanding and supportive.”

FERPA’s nondisclosure provisions do not create a personal right to enforcement, meaning private citizens generally do not have standing to sue for FERPA violations. Those who are damaged by a FERPA violation must contact the Family Policy Compliance Office of the U.S. Department of Education to launch a complaint. From there, the agency will investigate the claim, and take action based on its findings.

Certain measures are underway at UNT to educate and soothe student and family concerns of identity theft and institutional trust. First, to inform the students of the error, then offer assistance to those affected, which Robison’s office is currently overseeing.

In order to map the progress of students, educational institutions keep track of certain materials. FERPA mandates material remain confidential unless the student — or parent of an adolescent — authorize its release, or the information falls under another exception to the law. Further, FERPA requires students be allowed access to their information at any time to ensure its accuracy.

Under FERPA, the release of student names, addresses and phone numbers are not considered offenses to the law. That is deemed “directory information,” and therefore public, unless a student has requested confidentiality. Gender and ethnicity are not considered directory information, and were included in the leaked email. The dissemination of other data, such as one’s GPA, is illegal.

Business sophomore Desiree Butler said she wasn’t aware of the email leak until last week. She lives in student housing, so her mail comes to her late. She questions why the school did not email or call her to alert her more quickly.

“I know they made a mistake, but UNT should address it,” Butler said. “Maybe you should pull your employees in and retrain them.”

College of Business SGA Senator Xavier Carson is also a business undergraduate whose information was mishandled. He said many students may still be unaware of the information breach, and UNT should have emailed or phoned the students.

“I’m a little bit unaware why they didn’t send out emails. It’s just by chance that I went home that week. My home address is where I get all my UNT mail, just because you do a lot of moving as a college student,” Carson said. “It just doesn’t make sense to change that all the time.”

Carson, a senior who has been involved with SGA since his freshman year, said he is in search of a more open dialogue on the issue from the business advising office. Carson didn’t say exactly how student policy makers will act on the matter, although he has invited Robison to keynote an SGA meeting.

“I’m not sure what SGA can offer, being that there’s not really any precedence for this,” Carson said. “But I think [UNT] can offer some clarification. The staff members in that department need to be held accountable to their actions.”

When Carson first emailed Robison, he wasn’t keen on a FERPA violation. After consulting with former SGA president Troy Elliott, who alerted him of the illegality of the email leak, Carson said he questioned Robison further.

“Elliott told me it was a violation of FERPA. And so in the email communication, I asked her,” Carson said in an interview. “She stated, ‘Yes, we do know that. And we are doing everything that we can.’ I thought [that] was disappointing.”