Disclosure of student contact information
VCU instructional faculty, administrators and staff maintain the confidentiality of student records and disclose information in accordance with the federal Family Educational Rights and Privacy Act and Virginia law. This means that VCU officials disclose student records without the consent of the student to other university officials as necessary to perform their job duties because they are school officials who have a legitimate educational interest in the student information.
Federal law generally permits the university to publish a student’s directory information or disclose it to the public, but, importantly, Virginia law[1] requires the university to obtain a student’s affirmative written consent before disclosing their contact information (email address, physical address or telephone number) to anyone except either (1) a FERPA school official or, as of July 1, 2019, (2) a student enrolled in course(s) at VCU.
The university has developed a system for seeking consent to share student contact information with members of the university community. But any disclosure outside the university community requires separate written consent.
Automated consent
Students can easily give consent to display their email address to other VCU students (whether or not they are currently enrolled) and members of the VCU community by visiting MyVCU portal and activating the "privacy setting" toggle in the box in the upper left corner of the Student Tab (see images below).
Note that this consent is limited to disclosure within the university community and does not permit the university to display or provide a student’s email address to the general public.
Written consent
If a student has not provided consent through MyVCU portal or your intended contact information disclosure is outside of the scope of the MyVCU portal consent (e.g., to be posted on a syllabus that will be made available on the Internet, posted on a collaborative website, etc.), you must obtain affirmative written consent for the disclosure.
Quick points
Virginia law protects the contact information of students in all academic program levels: undergraduate, master’s, doctoral, first professional and certificate.
- Faculty will continue to have access to contact information for all students in their courses.
- Student consent is still required for non-academic use of directory information.
- NEW: Faculty members and administrators may disclose student contact information to other students enrolled in their courses; you are no longer required to blind copy student email addresses when the email is sent to students in a specific course/section.
- NEW: Faculty using Canvas for their classes may now use all email, roster and group functions without the need to blind copy.
- Faculty, administrators and staff must verify that all recipients of an email containing student emails are either students who are enrolled in courses or school officials. Otherwise, they may use the blind copy function.
- Students may share their emails. These privacy laws do not restrict email address sharing by students.
- If you wish to place student email addresses on a syllabus, website, etc., you must obtain affirmative written consent from each student.
- Faculty and staff can determine if a student has provided consent for disclosure within the university community through the MyVCU portal at directory.vcu.edu.
FAQ
How can a VCU employee ensure they have complied with the requirements for sharing student contact information?
If a unit needs to obtain student consent (e.g. to post a student’s email address on a public-facing website), it may modify and use the following consent language:
Template verbiage for departmental consent form (required for sharing student information):
VCU is committed to student information privacy. To (insert purpose of sharing), the VCU (insert unit) seeks your consent to publish or share your (university assigned email address, personal email address, phone number, or address) with (insert intended recipient(s), e.g., the general public or individual names, titles, organizations) through (insert mechanism(s) of sharing, e.g. posting on a unit website, direct email communication).
By (signing this form / enabling this option / checking this check box), you give your affirmative consent for the VCU (unit) to share your information as described above.
For questions related to this consent, modification of your contact information or revocation of your existing consent, please contact (insert contact information of the unit). Learn more about student information privacy.
If a student is paid by the university as a teaching assistant or in some other capacity, can they, as employees of the university, have their email addresses listed on the website?
If an individual’s employment requires them to be a student (e.g. teaching assistants, graduate assistants, RAs, some student workers), VCU may not post or disclose their student email address, phone number or physical address without consent. But VCU may publicly disclose the contact information of its other employees if such posting does not indicate that the employee is a student.
Does this law protect the contact information of medical residents in the VCU Health System?
No, medical residents are employees of the VCU Health System, and their contact information is not protected by FERPA or Code of Virginia § 23.1-405(C).
How does this law affect me as a faculty member?
Any faculty or staff member must refrain from disclosing a student’s email address, phone number or address to any individual who is not (1) a school official under the Family Education Rights and Privacy Act (FERPA) or (2) a student enrolled in course(s) unless the student has provided affirmative written consent for the disclosure.
I have student workers who routinely access the email address, phone number, or address of other students as a part of their job. Do I need to remove their access?
No, you do not need to remove their access. If a student worker is expected to access this information as a part of their job duties, then these student workers are school officials with the need to know this information. You should train student workers who access this information for their VCU employment that they may not access or use it for any purpose other than as necessary for their assigned job duties, with supervisory authorization, and with any necessary consent.
Does this law prohibit departments or student organizations from using email clients like MailChimp, Constant Contact, or third-party email distribution platforms?
Yes. If VCU has not designated the third-party platform as a school official through a written contract, then the university must obtain consent before disclosing student email addresses.
VCU employees using third-party resources should confirm that VCU’s relationship with the contractor satisfies FERPA’s school official exception or seek student consent.
Student organizations, however, are generally separate and independent from the university. Code of Virginia § 23.1-405(C) does not restrict use or disclosure by students, including student organizations, unless they perform delegated university functions.
Do faculty have access to student email addresses if they are not enrolled in one of their courses?
Faculty members are allowed to access student contact information if they need that information to perform their assigned job duties. Faculty members with an @vcu.edu email address can also look up student contact directly from their email by typing in the student’s name.
Are group emails to multiple students allowed?
Yes, group emails to multiple students are allowed if all student recipients are enrolled in course(s).
How does this affect online courses?
The law does not distinguish between online and other courses. VCU may not disclose students' email addresses, addresses and phone numbers to a non-university official, including to another student unless they are enrolled in courses. Online instructors must ensure that student information is available only to students enrolled in courses.
What about RamPages or similar blogs used in classes?
RamPages, blogs and websites are available to the general public. University faculty and staff members may not disclose student contact information publicly without affirmative written consent, regardless of the media used to publish or share information.
How does this law impact me as a student?
Code of Virginia § 23.1-405(C) generally prohibits a university from disclosing your email address, physical address or telephone number to anyone other than a school official or another student without your consent. Learn more about student information privacy.
As a student, may I send group emails to other students?
Yes, students and student organizations may use and share email addresses of other students. For example, a student organization may collect and distribute membership rosters. However, VCU may not provide the contact information for these rosters. As a matter of respecting the privacy of your peers, you may want to seek permission or permit objections before sharing or posting the contact information of others.
If you have additional questions about FERPA or the Virginia law protecting student contact information, Code of Virginia § 23.1-405(C), email the VCU Information Security Office (infosec@vcu.edu) or the Office of the University Registrar (rar@vcu.edu).
[1] Code of Virginia section 23.1-405(C), took effect July 1, 2018, and was amended July 1, 2019, to permit disclosure for university purposes to students enrolled in courses.(e.g. to be posted on a syllabus that will be made available on the Internet, posted on a collaborative website, etc.), you must obtain affirmative written consent for the disclosure. Suggested text for the request for consent is included in the first entry under "General" in the FAQ above.