Case Study: To Disclose or Not to Disclose…That Is the Question
Retrieve.com, an online systems vendor, has come to your campus to talk to you about outsourcing your student data base and placement files. The system requires a student to personally upload a resume for viewing by an employer. Only the student can upload the resume and it must be done from the student's account. The student can do this from his or her dorm room, apartment, or at the career services office. Only employers who are subscribers to the vendor's service and have a password can view the resumes. Retrieve.com assures you that there is no need for a written signature providing permission to disclose the resume to the employers. Since you have no student registration fee and are looking to streamline your efforts, eliminating a mandatory signature card would help.
Questions to consider:
- Are there privacy issues that you should be concerned with?
If so, what are they and what questions should you ask this vendor
regarding privacy? Even if you outsource, do your privacy obligations
to the student cease?
- What are your options? What are the pros and cons of those
options?
- Is there additional information you might try to get or need in order to reach a conclusion on how to proceed?
Steps to Resolution
1. What relevant facts are known?
a) Retrieve.com, a third-party, wants your office to consider outsourcing the student data base and placement files.
b) Further, they assure you that there is no need for written permission from the students to disclose their information.
c) Only subscribing employers can access your students' records.
d) Students must upload their resumes for inclusion in the data base.
However, we do not know:
e) Who are the employer subscribers, and do they comply with EEO guidelines?
f) What is Retrieve.com's privacy policy?
g) Will the office have to run a parallel data base to coordinate campus interviews?
h) Do employers pay a fee to Retrieve.com and is it significant enough to hinder access to your students?
i) If you outsource your data base to Retreive.com, does it preclude you from working with other vendors, i.e., is it an exclusive relationship?
2. Identify the NACE Principles in question.
a) Career Services #7: "Any disclosure of student information outside of the educational institution will be with prior consent of the student unless health and/or safety considerations necessitate the dissemination of such information. Career services professionals will exercise sound judgment and fairness in maintaining he confidentiality of student information, regardless of the source, including written records, reports, and computer data bases."
b) Also, according to information about the Electronic Signature Law provided on NACEWeb, there has been no determination by the U.S. Department of Education about how the law might impact the requirement of signed, written consent from a student prior to a school's disclosure of a student's education records to a third-party. Therefore, at present, it is still advised that such disclosure requires the hand-written signature of the student on a consent form.
c) Further, according to the Spotlight article, "Federal Agency Recommends Data Privacy Policies for Web Sites" (Nov. 1, 2001), the Federal Trade Commission encourages web sites to post privacy notices - and honor the promises in them - and include:
- type of data collected, including whether the organization uses 'cookies'
- uses for the collected data
- information regarding who can use the information
- names of third parties who have access to the information
- how users can opt out of the information collection process
- who to contact regarding an organization's privacy policies
3. Are there privacy issues that you should be concerned with?
There are certainly privacy issues: a) as noted above, students must give their written permission to disclose their information to a third-party; and b) the vendor may disclose personal information collected from the students and then pass that information on to other vendors, such as advertisers.
4. Discuss practical alternatives that are consistent with NACE Principles.
a) Use the services of Retrieve.com provided that the following three conditions are met. Otherwise, do not use their services.
- obtain written permission from students,
- determine that students' personal information will not be released after checking privacy policy of Retrieve.com, and
- determine that the fees paid, if any, by employers, do not hinder employer access to your students, thereby, limiting their opportunities.
