To: Faculty
From: Linda Anderson and John Papinchak, Directors of Enrollment Services
Date: August 28, 2000
Subject: Students' Right to Privacy

You are accountable for maintaining the privacy of student information in compliance with University and federal policies. The University policy is designed to comply with the provisions of the Family Educational Rights and Privacy Act (FERPA) of 1974, 20 U.S.C. Sec. 1232g. The specific policy can be found at http://gollum.mac.cc.cmu.edu/univ_policy/documents/StPrivacy.html. Good practice by faculty and staff members requires that they maintain, report and make available information included in student educational records in compliance with the requirements of FERPA and the University's Policy.

Student Information Disclosure
With certain exceptions, Carnegie Mellon officials will not disclose personally identifiable information from a student's education records without the student's prior written consent. "Directory Information" will be disclosed without the student's prior written consent unless the student has notified Enrollment Services in person, in writing within the first 15 class days of the semester in a given academic year to restrict release of that information. When student requests to have any or all directory information restricted, a private flag is set on the student record. No information should be released regarding that student's record, including their student ID number.

In virtually all cases, the University uses the student Social Security Number (SSN) as the student ID number. Federal regulations requiring our reporting the SSN for every student receiving any kind of federal financial aid or loan necessitate its continuing use for the time being.

Directory Information
Carnegie Mellon University has designated directory information to be:

  • Student's full name, campus electronic mail address, campus/local address, local telephone number, class, department, college of enrollment, dates of attendance, date(s) of graduation, and degree(s) awarded.
  • For those students participating in intercollegiate athletic events, personally identifiable information included as directory information is the sport of participation, height and weight.

NOTE: Parent name, address, and telephone number are not considered directory information.

Persons receiving non-directory information are responsible for protecting the confidentiality of the students involved. They are not permitted to re-release this data to others without the prior written consent of the students involved.

Student Information Guidelines
Some recommended guidelines and practices regarding protecting the confidentiality of student records are shown below:

  • DO NOT display student scores or grades publicly in association with names, student ID numbers, Social Security Numbers, computer user ids, or other personal identifiers. Because the student ID is not public information, posting non-directory information such as grades using any part of the student ID as an identifier is not permitted.
  • DO NOT put papers, homework set, exams, lab reports, etc. containing student names and grades in publicly accessible places. Students may not have access to the scores and grades of others in the class.
  • DO NOT share student educational record information, including grades or grade point averages, with other faculty or staff members of the University unless their official responsibilities identify their "legitimate educational interest" in that information for that student.
  • DO NOT share by phone or correspondence information from student educational records, including grades or grade point averages, with parents or others outside the institution, including letters of recommendation, without written permission of the student. Do Not share student educational record information, including grades or grade point averages, with other faculty or staff members of the University unless their official responsibilities identify their "legitimate educational interest" in that information for that student.
  • Do refer requests for information from the educational record of a student to the proper educational record custodian. Do Not share by phone or correspondence information from student educational records, including grades or grade point averages, with parents or others outside the institution, including letters of recommendation, without written permission from the student.
  • DO NOT request information from the educational record custodian without a legitimate educational interest and the appropriate authority to do so.
  • DO keep course records for a minimum of one year after the course ends. Do keep only those individual student records necessary for the fulfillment of your teaching or advising responsibilities. Private notes of a professor/staff member concerning a student and intended for professor's/staff member's own use are not part of the student's educational record.
  • DO keep any personal professional records relating to individual students separate from their educational records. Do keep any personal professional records relating to individual students separate from their educational records. Private records of instructional, supervisory and administrative personnel and ancillary educational personnel are to be kept in the sole possession of the maker and are not to be accessible or revealed to any other person, except a substitute. If basic research involves student data, instructors should follow University policies regarding the use of human subjects.
  • Do change factual information regarding grades and performance in an educational record when the student is able to provide valid documentation that information is inaccurate or misleading. The substantive judgment of a faculty member about a student's work, expressed in grades and/or evaluations, is not within the purview of a student's right to challenge their educational records.
  • Do Not include in a student's educational records or make available to him/her, or to a third party, information from medical, psychiatric, or psychological reports; records from law enforcement officials on or off the campus; or notes of a professional or staff person which are intended for that individual alone.

Course Rosters
Enrollment Services provides class lists only in electronic form. Instructors access this Web application through The HUB home page by using the secure browser software, Netscape. The rolls are only accessible to Netscape users. Course rosters are available at any time after student registration from the egrades web site. Faculty can access egrades from http://www.cmu.edu:8001/esg/staff.html. These rosters reflect all registration and drop/add activity for your course at the time you are accessing the electronic roster.

Course roster information can be loaded into an electronic grade book program or a spreadsheet. A course datafile is a comma delimited file you can download and use for sending electronic grade files. You can create a course datafile by course and section or use the 'ALL' option to retrieve all sections per course or every teaching course. Please note that datafile will not contain lectures (section 1-10) since lectures are not recorded at grading time.

Course rosters are formatted rosters that can be written to a screen to be printed or e-mailed to you. Course rosters print mid-term, final and default grades when applicable. Rosters can be run for a complete academic year (Fall, Spring, Summer1, Summer2). The course roster is the same format as the current paper roster that is distributed by Enrollment Services.

You can create a course roster by course and section or use the 'ALL' option to retrieve all sections per course or every teaching course. Unlike the course datafile or enter grades, class rosters will retrieve lectures (including sections 1-10).

The student ID number (usually the student's SSN) is routinely reported to faculty on class lists as an aid to identifying students. However, the student ID number (and SSN) is not considered public or directory information either by the University or by the definitions included in the Family Educational Rights and Privacy Act of 1974. As such, the student ID number (and SSN) may not be released to a third party without written permission from the student. THIS INCLUDES THE POSTING OF GRADES BY STUDENT ID NUMBER!

Grade Posting
We realize the service faculty provides to students by posting grades. We suggest the following guidelines to assist students but still remain within the law:

  • DO NOT display student scores or grades publicly in association with names, student ID numbers, Social Security Numbers, computer user ids, or other personal identifiers.
  • DO NOT post a copy of your class list or Final Grade Roster, even with the names removed. These lists are in alphabetical order.
  • If scores or grades are posted, use the last four digits of the student ID number (arranged numerically) , OR, Ask each student to give you a unique number known only to you and that individual student.
  • DO sort your list in numerical order. Displaying the list in alphabetical order allows students to infer other students identities.

Summary
We appreciate your attention to this matter of student privacy. This memo was prepared by Enrollment Services and is intended to provide important and useful information to all Carnegie Mellon faculty, instructors and staff.