11.0 Privacy and Disclosure of Information
Student Information Policy
- 1.0Definitions — Student Information
- 2.0Retention and Continuing Access to Student Information
- 3.0Disclosure of Student Information
- 4.0Disclosure of Student Information to Students
- 5.0Disclosure of Student Information to Institute Officials
- 6.0Disclosure of Student Information to Persons Outside MIT
- 6.1Disclosure of student information to parents and guardians
- 6.2Disclosure of student information to other academic institutions
- 6.3Disclosure of student information to government agencies
- 7.0Information Technology — The Use of Technology to Transmit Student Information
- 8.0Policy Oversight
1. Definitions — Student Information
1.1 Student information
This policy builds upon the Family Education Rights and Privacy Act (FERPA) of 1974, a federal law designed to protect students' privacy, and to provide them access to their education records. Under FERPA, "education records" include all records, in all tangible formats (print, electronic, visual, etc.) that are directly related to currently or formerly enrolled students and are maintained by an academic institution. MIT's implementation of FERPA uses the term "student information" (rather than "education records") to refer to information in all tangible forms including:
- Admission information for those students accepted by, and who enroll at MIT;
- Biographical information including date and place of birth, gender, nationality, information about race and ethnicity, and identification photographs;
- Grades, test scores, courses taken, academic specialization and activities, and official communications regarding a student's status;
- Course work including papers and exams, as well as communications that are part of the academic process between a student and the teaching staff, and between a student and other students in the class;
- UROP and internship program records;
- Students' financial and financial aid records;
- Disciplinary records.
The provisions concerning the disclosure of student information (Sections 4, 5 and 6) refer to the categories of student information described in 1.1.
1.2 Directory information
Certain categories of student information are designated by the Institute as directory information and may be released without the student's prior consent and without a record being made of these disclosures. This information includes:
- Term and permanent home address,
- MIT office address,
- Term phone number,
- Term electronic mail address,
- Year and registration type,
- Degrees received,
- Date of birth,
- Dates of attendance,
- Any honors and awards received,
- And for an intercollegiate athletic team member, weight and height.
Students have the right to withhold directory information from disclosure, including disclosure in printed and online publications of the directory, except to Institute officials who have a need to know it. (See Section 5 for a definition of Institute officials who have a need to know.) Requests to withhold directory information must be submitted by students in a timely manner to ensure that the information is removed before the Student Directory is published. (WebSIS contains instructions about how students may restrict information.)
The Student Directory, which is published yearly in the fall, and equivalent electronic versions, are intended primarily for use by members of the MIT community. MIT telephone operators will normally provide only a student's term phone number in response to an individual inquiry from outside MIT. Using or facilitating the use by others of the Student Directory or similar listings for non-Institute purposes is a violation of Institute policy. In making the student directory available online and accessible through the World Wide Web, MIT will take precautions to minimize prohibited uses of this information. However, MIT is not able to prevent the dissemination and use of directory information once it is acquired by outside parties.
1.3 Information subject to other or additional provisions
Certain categories of information relating to students are not subject to all of the provisions of Sections 3, 4, 5 and 6 below, or have additional restraints that apply to them. The following categories are ones that most frequently arise, although other kinds of information regarding students can also be treated differently from the provisions in Sections 3, 4, 5 and 6 as necessary and appropriate in the circumstances.
Personal files of Institute faculty and staff — Notes and similar records regarding a student that are made for, and restricted to, the personal use of a faculty or staff member are not subject to review by the student.
Campus Police records created for law enforcement purposes — Except for the daily log of the Campus Police Department that is open to public inspection under Massachusetts law, such records regarding students are not subject to review by students or others. The Campus Police Department, however, may in appropriate circumstances make such records available to other public safety agencies for law enforcement purposes.
Medical records maintained by the Medical Department — Medical records are subject to separate provisions of Massachusetts law that protect their confidentiality and that, subject to certain narrow limitations, make such medical records available for inspection and copying by patients.
Records of students as employees — Personnel records of employees are subject to separate provisions of Massachusetts law that make such records available for inspection by employees in most cases. In addition, student employment records that relate to jobs that students hold as a result of their being students at MIT (e.g. UROP, RA and TA positions) are also subject to Sections 3, 4, 5 and 6 below.
Parent's financial records — Students do not have the right to inspect financial information submitted by or about their parents unless this information is part of a student aid application form, which the student has signed.
Library circulation records — Information that identifies the intellectual pursuits of a particular student (e.g. library circulation records, interlibrary loan requests) will not be disclosed to others, including Institute faculty and staff, except as necessary for enforcement of library rules (e.g., collection of overdue fines and tracing missing volumes)
Alumni records — Information about former students that pertain to the time period after they have left the Institute may be used for general purposes determined by the Institute.
2. Retention And Continuing Access To Student Information
Student information (in paper and electronic formats) must be retained for appropriate periods of time and must be maintained to ensure both security and future needs. Staff and faculty must consult with the Institute Archivist to receive advice about the retention of student records, and permission to destroy any records. (Policies and Procedures, 13.3) No educational record may be destroyed if there is an outstanding request to inspect or review it. After a student leaves MIT, student information relevant to that student may be retained in academic and administrative offices, or in the Institute Archives. Access to these records is governed by FERPA, MIT policy on student information, as well as the MIT Institute Archives access policy. The later policy stipulates that access to student information will continue to be restricted in accordance with FERPA and MIT Policy normally for 75 years following the time that a student leaves MIT, or at the death of the student. When a student dies while enrolled at the Institute, MIT's normal use of that record for internal and external purposes will continue in accordance with the provisions of this policy. All other requests for access from individuals outside of MIT will be referred to the family or legal representative of the deceased student for a period of ten years following the death.
3. Disclosure Of Student Information
Sections 4, 5 and 6 describe the rights of students to have access to their records and to seek corrections of them, as well as the conditions under which others may have access to student information. When access to student information is granted to individuals, other than the students themselves, the following principles apply:
Disclosure of information to persons within the Institute — Student information should not be used or exchanged within the Institute for purposes other than those stated when the information was collected or to Institute officials with a need to know the information. A person who is given access to student information may not further disseminate or transmit the information he or she receives to another person unless that person has such permission as well.
Need to know — As discussed in Section 5, student information should be disclosed only to Institute officials who need to know it. The principle of need to know recognizes that faculty and staff may require access to student information to carry out their responsibilities. FERPA authorizes the disclosure of student information without a student's consent to school officials, but limits that access only to those individuals with a legitimate educational interest who need the information to fulfill their professional responsibilities. Therefore, this policy defines who Institute officials are and what activities constitute a legitimate need to know. (see Section 5) (As part of the implementation of this policy, specific directions will be developed to clarify who, under normal circumstances, can have access to what kind of information.)
Disclosure of information to persons outside MIT — Personally identifiable student information should not be disclosed to individuals or organizations outside of the Institute without the student's written consent, with certain exceptions that are explained in the provisions that follow. (see Section 6) The written consent must be signed and dated and must include a specification of the records to be disclosed, the purpose of the disclosure, and the party (or parties) to whom the disclosure is made. Upon request, the student shall be provided with a copy of a record that is disclosed.
Except in cases of directory information, court orders and subpoenas, or releases to students themselves, all records that contain student information that are released to persons or organizations outside of MIT must be released on the condition that no other party will have access to them without the student's written consent. The disclosed material must contain an agreement to the effect that acceptance of these materials constitutes an agreement to abide by this condition.
In emergencies, Institute officials can disclose student information necessary to protect the health or safety of the student or others.
Disclosure of student work within and outside the Institute — A number of academic disciplines have long-standing traditions of public disclosure of student work (e.g., products of design studios, collaborative/team class work, and graduate research results and reports). The provisions in this Student Information Policy are not intended to constrain the educational processes of these fields. However, schools, academic departments, laboratories, and centers that have such traditions should bring to their students' attention in advance the kinds of academic work of the students that will be made publicly available. Similarly, individual faculty members who use public disclosure of student work as part of the educational process in specific courses should make that fact known in advance to students who enroll in their class, if students have not been informed of the practice at the departmental or other broader level.
Maintaining a record of disclosures — Information about all disclosures of records containing student information, including the identity and legitimate interest of the party to whom disclosure was made, must be maintained as part of the student's record, with the following exceptions: releases of directory information, releases of information made to the student or with hers or his written permission, releases of information to Institute representatives under Section 5 of this policy, and releases of information in the case of grand jury or law enforcement subpoenas when a court orders that there be no disclosure of the request
4. Disclosure Of Student Information To Students
Students have a right, subject to the need to protect the privacy of other students, to review records, files, and data, held about them on an official basis by the Institute. Students also have the right to challenge the content of those records, files, and data that they believe are inaccurate, misleading, or otherwise in violation of their privacy and other rights.
4.1 Access to their records
All student information maintained by the Institute that is identified with an individual student or former student will be available for review at the request of that individual with the following exceptions. Students will not be given access to certain categories of records that are subject to other or additional provisions (see Section 1.3) nor to certain confidential letters of recommendation (see Section 4.3). In addition, an individual shall not be permitted to review those specific portions of his or her information that refers to other identified students. A student may make a request to see his or her record directly to the department or unit that maintains that record, or either the Office of the Dean of Students and Undergraduate Education or the Graduate Students Office. The right of access includes a right to an explanation or interpretation of the record, and the right to obtain copies of the record.
4.2 Request to challenge and amend a record and the right to a hearing
A student may challenge and/or add to the content of his or her information to ensure that their records are not inaccurate or misleading, or in violation of hers or his privacy or other rights. Challenges can also be made to correct or delete any inaccuracies or misleading or otherwise inappropriate data contained in hers or his record. The subjective judgments of a faculty member about a student's work, expressed in grades and/or evaluations, is not included in this right to challenge. Challenges should be submitted to the custodian of the record or through the Office of the Dean of Students and Undergraduate Education, or the Graduate Students Office. If the office to which the challenge is presented decides not to amend the record, the student may request a hearing. If, after such a hearing, the record is not amended as the student requests, the student may submit a statement to be included in the student's record commenting on the information and stating he or she disagrees with the decision not to amend the record as the student requested.
4.3 Letters of recommendation
Candid appraisals and evaluations of performance and potential are an essential component of the education process. With appropriate permission from the student, such information can be provided to prospective employers, to other institutions, or to other legitimately concerned outside individuals or agencies
A student may voluntarily waive his or her right to review or receive copies of such letters of recommendation. Waivers must be in writing, and must not be required as a condition for admission to, receipt of financial aid from, or receipt of any other services or benefits from an agency or institution.
5. Disclosure Of Student Information To Institute Officials
Institute officials who have a legitimate educational interest may have access without prior consent by the student to the specific student information that is needed to fulfill their professional responsibilities (need to know). An Institute official is a person employed by MIT in an administrative, academic or research, supervisory or support position (including law enforcement unit personnel and health staff); a person or company that acts for the Institute (such as an attorney, auditor or collection agent); a member of the MIT Corporation; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. It should be understood that access will be limited to the records of those specific students and categories of information to which the need pertains.
The following are examples of assigned responsibilities that constitute a legitimate need to know:
- Provide academic or personal advice and counsel to students,
- Administer academic programs,
- Create and maintain student educational records,
- Award and administer financial aid,
- Assess and collect fees,
- Supervise and certify student educational progress for Institute or government purposes,
- Enforce student conduct and discipline,
- Administer the residential system,
- Demonstrate Institute compliance with governmental regulations such as equal access and opportunity,
- Represent the Institute's legal interests in matters where a student record is relevant,
- Plan, conduct and review research related to the Institute's educational programs,
- Conduct individual research projects provided that the privacy of the students is protected.
5.1 Disclosure of information for institutional research
Included among the professionals whose responsibilities constitute a "legitimate need to know" are those MIT officials who, as part of their administrative responsibilities carry out institutional research: the analysis of data, including information about students that supports the evaluation of educational programs and more broadly, the planning and decision-making by the MIT faculty and staff. Institutional research also encompasses the reporting and analysis required by government and other outside agencies. MIT may participate in other independent and governmental studies that are not encompassed in the above definition if approved in advance by the Chancellor, and when appropriate by COUHES (the Committee on the Use of Humans as Experimental Subjects) as well.
Recognizing the legitimate nature of this work, it is also understood that research protocols must ensure the privacy of the subjects of this research and that the research must be in compliance with FERPA. Offices engaged in ongoing institutional research efforts will operate under agreed upon protocols that will be maintained and be made available on request.
5.2 Disclosure of student information to student employees
Some students are employed at MIT in academic and administrative offices where their responsibilities give them access to records of other students. When this is the case student employees will be asked to review written policies that explain the requirement to maintain confidentiality, and will sign an agreement to abide by these conditions. Access to information (such as MITSIS) for each student employee will be as limited as reasonably possible for them to accomplish their specific assigned responsibilities.
5.3 Disclosure of disciplinary charges and proceedings
Information concerning individual student disciplinary charges and proceedings, including the outcome of the proceedings, are subject to this policy, and therefore may not be disclosed except in accordance with Sections 3, 4, 5 and 6. As permitted by FERPA, and consistent with other provisions in this policy, victims of crimes of violence will be informed of the outcomes of disciplinary proceedings about those incidents. In addition, other schools with legitimate educational interests may, in appropriate circumstances, be informed of disciplinary actions taken against students on account of behavior that posed a risk to the students, other students, or members of the MIT community. In the case of sexual assaults, federal law requires that people who allege they were the victims of such assaults be informed of the outcome of any disciplinary proceedings related to their accusations.
5.4 Lists of students (e.g. lists of students by course, country, living group, etc. as well as electronic class lists).
Class lists, with identification photographs, will be distributed to faculty and staff associated with specific classes, for their reference purposes only. If class list information, including identification photographs, is to be placed on a class web site, access must be restricted to the students and staff of that class only. Instructors will not post the image of any student on the class web page if that student asks that his or her picture not be used for that purpose. Before making class information available more generally, (e.g. on a web page that is accessible to others at MIT beyond the class and/or to the public) faculty must receive permission from each student to post identification photographs and information. Similar prohibitions apply to the use of other lists of students. (See also Section 7.2, restrictions on access to class lists.)
Lists of grades with any form of potentially personal identification must not be posted in electronic or paper form. Graded student work (problem sets, exams, papers) should be returned to students in a manner that will protect the privacy of graded materials and minimize access by others.
6. Disclosure Of Student Information To Persons Outside Mit
6.1 Disclosure of student information to parents and guardians
FERPA prescribes that once a student has reached the age of 18 or has enrolled at a post-secondary institution, the right of access to the student's information in general passes from the parent or guardian to the student. MIT has a long-standing policy of communicating confidentially with students with respect to their academic, health and advising matters, but also of encouraging students themselves to share such information with their parents or guardians. In extraordinary cases, or in an emergency, and consistent with applicable laws, when health and safety issues require, the cognizant Dean may consult with parents, guardians, individuals designated by the student or others as appropriate. Individuals contacting the Institute for information about a specific student should be referred to the Office of the Dean of Students and Undergraduate Education or the Graduate Students Office.
6.2 Disclosure of student information to other academic institutions
Student information may be disclosed, without a student's prior consent, to officials of another educational institution in which the student seeks or intends to enroll, or in which the student is enrolled concurrently. As a condition, FERPA requires that the student must be notified of the disclosure, and upon request, receive a copy of the disclosed information. The disclosure of disciplinary charges and proceedings to other academic institutions is covered in Section 5.3.
6.3 Disclosure of student information to government agencies
6.3.1 U.S. Immigration and Naturalization Services (INS)
Students who hold temporary, non-immigrant visas with F-1 classification are required by the U.S. Immigration and Naturalization Services (INS), when applying for these visas, to authorize MIT to release to INS, upon its request, certain information and documents about themselves. A detailed description of the information subject to these requirements may be obtained from the International Students' Office. It is MIT's policy to release such information only to the extent required by law, except when the student requests the disclosure. Refer questions about international students to the International Students' Office.
6.3.2 Law enforcement Agencies
Representatives of the FBI, Secret Service and other law enforcement agencies occasionally contact members of the faculty and staff with inquiries about current and former MIT students, generally for background checks or for criminal or other investigations.
Background checks — Faculty and staff may provide information to law enforcement agents, or their representatives, who are conducting background checks, ONLY when they can present a form signed by the student authorizing the investigation.
Other investigations — All other inquiries for information about students made by law enforcement agents in conjunction with an investigation require a subpoena for that information. (See Section 6.4 below.)
6.3.3 Commonwealth of Massachusetts
Massachusetts law permits local municipalities, such as the cities of Cambridge and Boston, to obtain census information pertaining to students living in MIT residences. (General Laws of Massachusetts, Chapter 51, Section 10A.)
6.3.4 Accrediting organizations and state or federal education authorities
Student information can be released to these organizations in accordance with FERPA conditions when the information is needed to monitor, audit, or evaluate educational programs or for the enforcement of legal requirements related to educational programs. Release of information must comply with the policy controlling its reuse outlined in Section 3.
6.4 Disclosure of student information for legal purposes
Subpoenas and court orders requesting information about a student(s) must be referred to the Office of the Dean of Students and Undergraduate Education, or the Graduate Students Office. In such cases, unless prevented by court order, the individual student(s) will be notified of the request as soon as possible and the required information will be released only by an authorized officer of the Institute.
6.5 Disclosure of student information to the media
Requests from the media about current and former students should be directed to the News Office. Permission to release information, other than directory information, must be obtained from the student.
7. Information Technology — The Use Of Technology To Transmit Student Information
Electronic communication has transformed both academic and administrative activities and will continue to facilitate greater communication among faculty, students, and staff. While there are obvious benefits inherent in the technology, precautions must be taken to protect personal privacy and the confidentiality of student information. All members of the MIT community are expected to abide by MIT policies on the use of information technologies (Policies and Procedures, MITnet Rules of Use)
7.1 Electronic Mail
As email has become an integral part of the academic process, confidential information about MIT students is being transmitted, including evaluations and grades. Faculty, staff and students must recognize that although there is an expectation of privacy, unencrypted email is not a secure means of transmitting information. Federal law and Institute policy make it clear that the unauthorized interception of email is a serious offense. In light of those legal and policy rules, this policy does not prohibit student information from being transmitted by email. However, caution must be exercised about the content of messages and the access to email files and machines in which confidential information resides.
7.2 School, department, laboratory and class web pages
School, department and lab web pages — Faculty, staff and students must exercise caution in posting directory and other information to a web page that is accessible to MIT and/or to the public. Students have the right to withhold directory and other information from public distribution. Faculty and staff must receive permission from each student to post personal information and identification photographs to web pages.
Web class pages — Email and web based class work will remain central to the education process. While most class-related information posted on web sites can be public (syllabus, reading list, assignments etc.), individual communication with students as well as the work prepared by the students for the class (papers, proposals, drawings, etc.) are regarded as student information. Therefore, the following three categories of information must be restricted to use by the staff and students of that class only:
- Class lists, including identification photographs (See also section 5.4 on restrictions on access to class lists.),
- Online discussions among faculty, staff and students in which student participation is required and the student contributors are identified, and
- Student papers, reports and other work (that do not contain grades) (See also section 3 — Disclosure of student work within and outside the Institute, for exceptions to this restriction).
At the beginning of the term (before identification photographs and other class list information is posted) Faculty should inform the students about how technology will be used during the class, and specifically how student information will be handled: e.g. what information will be posted to the class web page, who will have access to that information, and how long it will remain available. Instructors will not post the image of any student on the class web page if that student asks that his or her picture not be used for that purpose. In addition to the faculty and teaching assistants associated with the class, the "staff" of the class can include adjunct members from outside the Institute or others whom the instructor(s) identifies. Faculty members are encouraged to remove class lists, email discussions and student work from the class web pages following the end of the term. Faculty must obtain permission from individual students if their work will remain available following the term of the class. Permission must also be obtained if the work is to be posted to a web page that is accessible to MIT and/or to the public.
8. Policy Oversight
Two mechanisms will be used to oversee and monitor this policy:
- The Committee on Student Information Policy as an advisory committee to the Chancellor, the Dean for Undergraduate Education, the Dean for Student Life and the Dean for Graduate Education.
- The Student Information Policy Officers
8.1 The Chancellor and the Committee on Student Information Policy
The Committee on Student Information Policy will be co-chaired by the Registrar and a member of the faculty. The membership of the committee will include students, faculty, and staff, including staff from the Chancellor's Office, Information Systems, and an Academic Administrator. The purpose of the committee is to advise the Chancellor, who will:
- oversee the implementation of this policy, including establishing processes that are needed to facilitate the implementation
- interpret the policy, resolve disputes, and respond to questions as they arise
- hear student complaints
- review and update the policy as needed and recommend revisions to the Dean for Undergraduate Education, the Dean for Student Life, the Dean for Graduate Education, and other senior officers
- review compliance and oversee the education of the community on this matter.
8.2 The Student Information Policy Officers
Each academic and administrative unit at MIT will name one or more Student Information Policy Officers (SIPO). Ideally the person(s) named will be a member of the faculty and/or staff who already has knowledge of and responsibility for student information issues. The SIPO will act as a local information resource responding to questions from faculty, staff, and students about access to and appropriate use of student information. They will review and advise about all local requests for reuse of student information. Questions that the SIPO's cannot answer will be referred to the Dean for Undergraduate Education, the Dean for Student Life or the Dean for Graduate Education, or the Chancellor, as applicable. The deans and the SIPO may seek advice from the Student Information Policy Committee.