FAQ about Code of Virginia § 23.1-405(C)
What is HB1?
Virginia House Bill 1 (HB1), which takes effect July 1 as Code of Virginia section 23.1-405(C), prohibits a university from disclosing a student’s email address, physical address or telephone number under the exception in the Family Educational Rights and Privacy Act (FERPA) for directory information or the Virginia Freedom of Information Act (FOIA) unless the student has affirmatively consented in writing to the disclosure.
Key points regarding this bill:
- This legislation covers students in all academic program levels: undergraduate, master’s, doctoral, first professional and certificate.
- Faculty will continue to have access to contact information for all students in their courses. They just will not be able to share that information without the student’s written consent.
- Students will no longer be able to find contact information for another student through phonebook.vcu.edu or the people search on the VCU website. A student may choose to provide written consent to allow their contact information (name, email address) to be accessible.
- University online applications — such as Blackboard, email, room reservation systems and Service Desk — will no longer provide the ability for non-employees to search for student eID and email addresses, including the auto-complete feature of email addresses currently used in many systems.
Other commonly asked questions about this legislation include:
A central process is not available at the moment. VCU will consider the development of such process in the future. In the meantime, the university will not be able to verify whether a student has provided the requisite consent. If you are a university official who must disclose student address, email or phone number before the university develops a process for central management of consents, please contact the Office of Records and Registration at email@example.com.
VCU may publicly disclose contact information of its employees. Some individual employees may also be students, but VCU need not rely on FERPA’s directory information exception to disclose an employee’s email address publicly. However, if an individual’s employment requires them to be a student (e.g. graduate assistants, RAs, some other student workers), VCU may not post their student email address, phone number or physical address without consent.
HB1 does not distinguish between graduate students and other students. VCU may not publicly post a graduate student’s email address, phone number or address without their affirmative written consent.
No, residents are employees of the VCU Health System, and their contact information is not protected by FERPA or restricted by HB1 except that VCU may not provide their information in response to a request under the Virginia Freedom of Information Act (FOIA) without consent.
VCU is working to ensure that faculty and staff who need access to student contact information can access that information through available electronic resources, such as Blackboard and eServices. However, any faculty or staff member who accesses student contact information must refrain from disclosing a student’s email address, phone number or address to any individual who is not a university employee or other school official under the Family Education Rights and Privacy Act (FERPA) unless the individual student has provided affirmative written consent for the disclosure. Importantly, a faculty member may not disclose one student’s contact information to another student without requisite consent. For example, to avoid disclosing student email addresses when communicating with multiple students, faculty may blind copy students or use a listserv or other tool to protect individual student email addresses from disclosure.
VCU will redact student names and email addresses from the phonebook.vcu.edu website; this will remove the ability for anyone to search for a student’s VCU assigned email address from the Internet. Additionally, unless consent is provided, VCU schools and departments will redact student contact information from departmental websites managed by schools and departments within the university.
As a faculty member, despite the removal of student email information from publicly accessible websites, you will retain access to class roster information in Blackboard and eServices. Additionally, faculty and staff will have the ability to look for student email addresses in your email system by simply typing in the student’s name in the recipient or blind copy field. Finally, VCU Technology Services is working to provide a searchable student directory for faculty and staff members through the VCU employee portal at my.vcu.edu. Currently, we are looking at making this searchable student directory available by end of July 2018.
In this case, an email will satisfy the consent requirement if it is sent from the student’s @vcu.edu address to an employee’s official @vcu.edu address. This email must provide clear consent for the department to disclose the student’s email address, address, and / or phone number. Upon receipt of the email consent, the department should reply to the student and acknowledge the given consent, provide the student with contact information if they decide to withdraw the consent, correct/modify their information, or review the information disclosed. The department must keep a permanent copy; such as a saved pdf copy of the consent message until the disclosed information is removed.
No, you do not need to remove their access. If a student worker is expected to access this information as a part of their job duties, then these student workers are VCU employees and university officials with the need to know this information. While these student workers and other employees who handle this information must be made aware that they may not disclose this information without supervisory authorization and written consent from the affected students, no additional action is needed for their continued access to this information. It is advisable to remind student workers who access this information for their VCU employment that they may not access or use it for any purpose other than as necessary for their assigned job duties.
While HB1 does not place restrictions on employee’s access to student contact information, it does prohibit disclosure of student contact information to other students. As such, class rosters will not be available to students.
VCU may disclose student information to a third party contractor as a “school official” if VCU has delegated a university function to the contractor, which would otherwise be performed by a VCU employee, and VCU maintains control over the contractor’s use and disclosure of the information. VCU employees using third-party resources should confirm that VCU’s relationship with the contractor satisfies FERPA’s “school official” exception or seek student consent. HB1 does not restrict use or disclosure by students, including student organizations, unless they perform delegated university functions.
Faculty members are allowed to access student contact information if they need that information to perform their assigned job duties. VCU Technology Services is currently working to provide continued access to this information through the VCU employee portal at my.vcu.edu. Faculty members with an @vcu.edu email address can also look up student contact directly from their email by typing in the student’s name.
Emails, phone calls, and in person communications can be used to interact with students. However, faculty members must take precaution when handling student contact information; without written consent from the student, faculty members cannot share the student’s email address, address, and phone number with any non-school official, including another student.
Yes, group email to multiple students are still allowed, but faculty members cannot disclose a student’s email address to another student. Therefore, in order to email a group of students, the faculty member should add the students' email addresses in the bcc field, or email the students through a listserv.
The law does not distinguish between online and other courses. VCU may not disclose student email address, address, and phone numbers to a non-university official, including to another student. Online instructors may need to revise the delivery and administration of an online course to avoid disclosing this information.
University faculty and staff members may not disclose student contact information without affirmative written consent, regardless of the media used to publish or share information. This includes publication on RamPages, blogs, or other websites by VCU employees.
If a VCU employee would like to provide a student's email address, phone number or address to any other individual, there are generally* two options:
- School official exception: Determine that the intended recipient (a) has a job-related need for the student's information and (b) is a VCU employee or has a legally binding contract with VCU requiring it to perform university functions and use the student information only for the purpose of fulfilling the contract obligations, which satisfies FERPA's "school official" exception OR;
- Consent: Obtain and keep a record of the student's affirmative written consent given through their VCU email, VCU-authenticated login or in-person signature. See draft consent below* *.
* Another FERPA exception may apply in certain limited circumstances. For guidance, you may consult Records and Registration or the Office of University Counsel.
If a unit needs to craft its own consent form for use cases specific to the unit (e.g. posting of student email addresses on the unit’s public website), then the following template verbiage can be modified and used by the unit to seek consent from students.
Template verbiage for departmental consent form (required for sharing student information)
VCU is committed to information privacy for members of its community. In order to (insert purpose of sharing), the VCU (insert unit) seeks your consent to publish and share your (university assigned email address, personal email address, phone number, or address) with (intended recipient(s)) through (mechanism(s) of sharing).
By (signing this form / enabling this option / checking this check box), you give your affirmative consent for the VCU (unit) to share your information as described above.
For questions related to this consent request, modification of your covered information, or revocation of your existing consent, please contact (insert contact information within unit). For more information on student privacy rights, please visit http://go.vcu.edu/ferpa.
No — Blackboard is now configured to automatically blind carbon copy (bcc) all students that are setup as recipients of a message sent by the instructor through Blackboard. More information on this feature is also posted on the VCU Technology Services website.
HB1 prohibits a university from disclosing a student’s email address, physical address or telephone number under the exception in the Family Educational Rights and Privacy Act (FERPA) for directory information or the Virginia Freedom of Information Act (FOIA) unless the student has affirmatively consented in writing to the disclosure. This restriction also applies to the university’s disclosure of one student’s information to another student.
As such, VCU will redact student names and email addresses from the phonebook.vcu.edu website; this in turn will also remove the ability for anyone to search for a student’s VCU assigned email address from the Internet. Additionally, unless a student provides consent, VCU will redact student contact information from departmental websites managed by schools and departments within the university.
Finally, in order to limit the disclosure of student contact information to other students, VCU will remove the ability for students to search for other students’ email addresses in the VCU email system, and Blackboard course roster.
The legislation prohibits the university from disclosing a student’s contact information to another student without written consent. Therefore, the university cannot directly provide you with another student’s contact information unless that student has consented to the disclosure. You may obtain a classmate’s contact information directly from them or from a list or directory in which your classmate has given the university consent to post their contact information.
The law restricts disclosure by VCU but does not restrict any disclosure by students or others of information they lawfully possess. For example, if a student organization collects and distributes membership rosters, that disclosure is not restricted by this law. However, VCU may no longer provide the contact information for these group rosters. As a best practice, anyone may want to seek permission or permit objections before publishing the contact information of others.
If you have additional questions about Code of Virginia § 23.1-405(C), please contact:
- VCU Technology Services: Information Security Office (firstname.lastname@example.org)
- Academic Affairs: Records and Registration (email@example.com)