FAQ about Code of Virginia § 23.1-405(C)
If a VCU employee would like to provide a student's email address, phone number or address to any other individual, there are generally* two options:
- School official exception: Determine that the intended recipient (a) has a job-related need for the student's information and (b) is a VCU employee or has a legally binding contract with VCU requiring it to perform university functions and use the student information only for the purpose of fulfilling the contract obligations, which satisfies FERPA's "school official" exception OR;
- Consent: Obtain and keep a record of the student's affirmative written consent given through their VCU email, VCU-authenticated login or in-person signature. See draft consent below* *.
* Another FERPA exception may apply in certain limited circumstances. For guidance, you may consult Records and Registration or the Office of University Counsel.
If a unit needs to craft its own consent form for use cases specific to the unit (e.g. posting of student email addresses on the unit’s public website), then the following template verbiage can be modified and used by the unit to seek consent from students.
Template verbiage for departmental consent form (required for sharing student information)
VCU is committed to information privacy for members of its community. In order to (insert purpose of sharing), the VCU (insert unit) seeks your consent to publish and share your (university assigned email address, personal email address, phone number, or address) with (intended recipient(s)) through (mechanism(s) of sharing).
By (signing this form / enabling this option / checking this check box), you give your affirmative consent for the VCU (unit) to share your information as described above.
For questions related to this consent request, modification of your covered information, or revocation of your existing consent, please contact (insert contact information within unit). For more information on student privacy rights, please visit http://go.vcu.edu/ferpa.
A central process is currently being developed. For urgent requests, please contact the Office of Records and Registration at email@example.com.
VCU may publicly disclose contact information of its employees. Some individual employees may also be students, but VCU need not rely on FERPA’s directory information exception to disclose an employee’s email address publicly. However, if an individual’s employment requires them to be a student (e.g. graduate assistants, RAs, some other student workers), VCU may not post their student email address, phone number or physical address without consent.
HB1 does not distinguish between graduate students and other students. VCU may not publicly post a graduate student’s email address, phone number or address without their affirmative written consent.
No, residents are employees of the VCU Health System, and their contact information is not protected by FERPA or restricted by HB1 except that VCU may not provide their information in response to a request under the Virginia Freedom of Information Act (FOIA) without consent.
Any faculty or staff member who accesses student contact information must refrain from disclosing a student’s email address, phone number or address to any individual who is not a university employee or other school official under the Family Education Rights and Privacy Act (FERPA) unless the individual student has provided affirmative written consent for the disclosure. Importantly, a faculty member may not disclose one student’s contact information to another student without requisite consent. For example, to avoid disclosing student email addresses when communicating with multiple students, faculty may blind copy students or use a listserv or other tool to protect individual student email addresses from disclosure.
VCU has redacted student names and email addresses from the phonebook.vcu.edu website; this will remove the ability for anyone to search for a student’s VCU assigned email address from the Internet. Additionally, unless consent is provided, VCU schools and departments should redact student contact information from departmental websites managed by schools and departments within the university.
As a faculty member, despite the removal of student email information from publicly accessible websites, you will retain access to class roster information in Blackboard and eServices. Additionally, faculty and staff will have the ability to look for student email addresses in your email system by simply typing in the student’s name in the recipient or blind copy field. VCU Technology Services is working on a version of eID tools that will be made available to employees and will display the status of the student's consent.
In this case, an email will satisfy the consent requirement if it is sent from the student’s @vcu.edu address to an employee’s official @vcu.edu address. This email must provide clear consent for the department to disclose the student’s email address, address, and / or phone number. Upon receipt of the email consent, the department should reply to the student and acknowledge the given consent, provide the student with contact information if they decide to withdraw the consent, correct/modify their information, or review the information disclosed. The department must keep a permanent copy; such as a saved pdf copy of the consent message until the disclosed information is removed.
No, you do not need to remove their access. If a student worker is expected to access this information as a part of their job duties, then these student workers are VCU employees and university officials with the need to know this information. While these student workers and other employees who handle this information must be made aware that they may not disclose this information without supervisory authorization and written consent from the affected students, no additional action is needed for their continued access to this information. It is advisable to remind student workers who access this information for their VCU employment that they may not access or use it for any purpose other than as necessary for their assigned job duties.
While HB1 does not place restrictions on employee’s access to student contact information, it does prohibit disclosure of student contact information to other students. As such, class rosters will not be available to students.
VCU may disclose student information to a third party contractor as a “school official” if VCU has delegated a university function to the contractor, which would otherwise be performed by a VCU employee, and VCU maintains control over the contractor’s use and disclosure of the information. VCU employees using third-party resources should confirm that VCU’s relationship with the contractor satisfies FERPA’s “school official” exception or seek student consent. HB1 does not restrict use or disclosure by students, including student organizations, unless they perform delegated university functions.
Faculty members are allowed to access student contact information if they need that information to perform their assigned job duties. VCU Technology Services is currently working to provide continued access to this information through the VCU employee portal at my.vcu.edu. Faculty members with an @vcu.edu email address can also look up student contact directly from their email by typing in the student’s name.
Emails, phone calls, and in person communications can be used to interact with students. However, faculty members must take precaution when handling student contact information; without written consent from the student, faculty members cannot share the student’s email address, address, and phone number with any non-school official, including another student.
Yes, group email to multiple students are still allowed, but faculty members cannot disclose a student’s email address to another student. Therefore, in order to email a group of students, the faculty member should add the students' email addresses in the bcc field, or email the students through a listserv.
The law does not distinguish between online and other courses. VCU may not disclose student email address, address, and phone numbers to a non-university official, including to another student. Online instructors may need to revise the delivery and administration of an online course to avoid disclosing this information.
University faculty and staff members may not disclose student contact information without affirmative written consent, regardless of the media used to publish or share information. This includes publication on RamPages, blogs, or other websites by VCU employees.
No — Blackboard is now configured to automatically blind carbon copy (bcc) all students that are setup as recipients of a message sent by the instructor through Blackboard. More information on this feature is also posted on the VCU Technology Services website.
HB1 prohibits a university from disclosing a student’s email address, physical address or telephone number under the exception in the Family Educational Rights and Privacy Act (FERPA) for directory information or the Virginia Freedom of Information Act (FOIA) unless the student has affirmatively consented in writing to the disclosure. This restriction also applies to the university’s disclosure of one student’s information to another student.
As such, VCU has redacted student names and email addresses from the phonebook.vcu.edu website; this in turn will also remove the ability for anyone to search for a student’s VCU assigned email address from the Internet. Additionally, unless a student provides consent, VCU will redact student contact information from departmental websites managed by schools and departments within the university.
Finally, in order to limit the disclosure of student contact information to other students, VCU has removed the ability for students to search for other students’ email addresses in the VCU email system, and Blackboard course roster.
The legislation prohibits the university from disclosing a student’s contact information to another student without written consent. Therefore, the university cannot directly provide you with another student’s contact information unless that student has consented to the disclosure. You may obtain a classmate’s contact information directly from them or from a list or directory in which your classmate has given the university consent to post their contact information.
The law restricts disclosure by VCU but does not restrict any disclosure by students or others of information they lawfully possess. For example, if a student organization collects and distributes membership rosters, that disclosure is not restricted by this law. However, VCU may no longer provide the contact information for these group rosters. As a best practice, anyone may want to seek permission or permit objections before publishing the contact information of others.
The answer to this question depends on whether the "registration process" is run by the university or by the student organization:
- University-run registration: Under the new Virginia law, a VCU employee may not provide student email addresses to a student organization. If university staff manage the registration process and records, then students must affirmatively consent to the disclosure of their email addresses to other students. University staff may incorporate the template consent language into their registration forms.
- Student-run registration: If a student organization collects the email addresses of students (e.g., its members) directly or retrieves them from the student-facing email directory (which contains only the email address of students who have affirmatively consented to have their address shared with other students), then students in the organization may use and disclose those email addresses, including by using MailChimp. The Virginia law does not restrict disclosure by students. Of course, VCU should encourage students to consider the privacy of their classmates when disclosing their contact information and to read the terms of conditions of sites or services they intend to use.
If you have additional questions about Code of Virginia § 23.1-405(C), please contact:
- VCU Technology Services: Information Security Office (firstname.lastname@example.org)
- Academic Affairs: Records and Registration (email@example.com)