Data Privacy and Central Wyoming College - Some Musings

Data Privacy and Central Wyoming College - Some Musings

Here are two quick take-aways:

• Students:  It is not clear to me at this time if STUDENT account's electronic information (email/documents/etc) is legally "private" or not.  It might fall under the State of Wyoming's definition of a "public record."  If the college received an external request for student account e-information, we would seek legal advice on how to respond.  We are also currently in a process with the other colleges and the university in Wyoming to seek a Wyoming State Attorney General's opinion on this matter.
• Staff:  It seems pretty clear that any e-information in a CWC STAFF account likely DOES qualify as a "public record: - though here too we would likely seek legal advice if confronted with an external request.  My advice (and college policy) is pretty clear on this:  Your staff account e-information has "no legal expectation of privacy."

Read on if you would like some details.

If information is a "public record" then the college is required by law to release it to anyone who requests to see it - unless doing so would violate some other law.  If the requester simply wants to view the information - and comes to CWC to do so - I believe it is required that this information be provided for free.  Otherwise, I believe the college is allowed to charge a "copy charge" to send them a copy of the information.

So here is what happens if an external request comes in to access college information:

1. The college works with the requester to clearly define the request
2. College personnel then review the information privately to determine if it is a public record.  For example, an email between two people may or may not be a public record.  If it contains an educational record as defined by FERPA (a federal student information privacy law) it is NOT a public record - and in fact releasing it to an unauthorized person is itself a violation of law.  Likewise for other information like health information (HIPPA), credit card information or a person's Social Security number.  Any such information would either be redacted from the copy of the information released - or not released at all if redaction would still constitute a violation.
3. Finally, the law requires the college to release anything determined to be a "public record" to the requester.

How could any of this possible affect me, you ask?  I heard a story (which I admit is unconfirmed but sounds plausible to me) of a public college employee going through a nasty divorce proceeding.  Because it was deemed that the employee email was a "public record" the aggrieved spouse did NOT need to prove that access to email was warranted in this case by getting a court order to view the email - they simply needed to make a request for the public record.

My advice:
Don't use your college account for personal communications.  Just don't do it!

John