Date: Thu, 1 Oct 1992 02:02:48 GMT
From: "Carl M. Kadie" <kadie@herodotus.cs.uiuc.edu>
Newsgroups: comp.society.privacy
Subject: Re: SSN in login ids
Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 087, Message 3 of 11

Eric Hunt <bsc835!ehunt@uunet.uu.net> writes:

>The University of Alabama/Birmingham's Engineering dept uses a student's 
>full SSN as a part of their computer login ids. This machine in Internet
>reachable. 
>
>I was wondering what relevant laws, if any, applied to this situation?
[...]

I think this is likely a violation of FERPA. I'm enclosing information.

============== ftp.eff.org:pub/academic/law/ferpa ===========
[From _College and University Student Records: A Legal Compendium_,
Edited by Joan E. Van Tol, 1989]

================== p. 119 ===============
The regulations ... were significantly modified in 1988. ... The
new regulations amend the definition of directory information
and establish a standard for the designation of directory information.
The new definition is:

' ... information contained in an education record of a student which
would not be considered harmful or an invasion of privacy if
disclosed.  It includes, but is not limited to, the student's name,
address, telephone list, date and place of birth, major field of
study, participation in officially-recognized activities and sports,
weight and height of members of athletic teams, date of attendance,
degrees and awards received, and the most recent previous educational
agency or institution attended.'

The new standard -- that which would not be considered harmful or an
invasion of privacy if disclosed -- permits the educational
institution to exercise its discretion in the designation and and
release of directory information provided that the eligible student
does not object to the disclosure.

======================== p. 106 ============
[From the regulations: 34 C.F.R., 99.37 (1988)]

99.37 What conditions apply to disclosing directory information?

(a) An educational agency or institution may disclose directory information
if it has given public notice to parents of students in attendance and
eligible student is attendance at the agency or institutional of --

(1) The types of personally identifiable information that the
agency or institution has designed as directory information;

(2) A parent's or eligible student's right to refuse to let the agency
or institution any or all of those types of information about the
student as directory information; and

(3) The period of time within which a parent or eligible student has
to notify the agency or institution in writing that he or she does
not want any or all of those types of information about the student
designed as directory information.

================== p. 155 ================ 
[from a reprint of an article printed in 1982 in _Computer/Law
Journal_ by a Ms. Hyman.]

 ... A waiver of FERPA rights made pursuant to section 99.7 must be
exercised by the student {109} and can apply to all FERPA rights
{110}.  Wavers must be signed {111}, and are most commonly given
regarding letters of recommendation for admission {112}. Institutions
may request students to waive their right of access to these letters,
but they may not require a waiver as a condition for admission or
services.{113}.

[References]
{110} 34 C.F.R. 99.7(a) (1980)
{113} 34 C.F.R, 99.7(b) (1980) [Which I think cooresponds to this section of the 1988
regulations - cmk]

====================== p. 104 =================
[34 C.F.R. 99.12 (1988)]

99.12 What limitations exist on the right to inspect and review
records?  ...

(b) A postsecondary institution does not have to permit a student to
inspect and review educational records that are -- ...

(3) Confidential letters and confidential statement of recommendation
places in the student's records ..., if

(i) The student has waived his or her right to inspect and review
those letters and statements;
 ...

(c) A waiver under paragraph (b)(3)(i) of this section is valid only
if --

(i) The educational agency or institution does not require the waiver
as a condition for admission to or receipt of a service or benefit
form the agency or institution;

 ...
============================================
--
Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign