Here’s a case I found interesting…the U.S. District Court for the Eastern District of Tennessee ruled on October 24th that providing a group of record company plaintiffs with student personally identifiable information (PII) does not violate the U.S. Family Educational Rights and Privacy Act (FERPA).
The U.S. District Court for the Eastern District of Tennessee denied an unnamed student defendant’s motion to quash a subpoena issued to the University of Tennessee at Knoxville.
Record companies filed suit against 33 unknown defendants who allegedly used the university’s computer network to engage in the illegal sharing of copyrighted music.
The court allowed the plaintiffs to serve subpoenas on the school in its role as the Internet service provider for the defendants.
The subpoenas requested the university to provide each defendant’s name, address, telephone number, email address and Media Access Control (MAC) address, which identifies the computing device used to connect to the university’s network.
Doe Number 28 filed a motion to quash the subpoena seeking his information. He argued that FERPA prohibited the release of his PII to the record company. He pointed out that neither he nor his parents consented to allow the university to release of the requested information to the plaintiffs.
The court ruled there was nothing within FERPA, nor within the university’s policy, that prevented the release of the subpoenaed information to the plaintiffs.
Judge H. Bruce Guyton ruled that under both FERPA and the university’s policy, directory information, including the student’s name, current and permanent address, telephone numbers and email address, are not considered educational records containing PII, and therefore are subject to discovery.
Just consider how this case may have had a different outcome if the university’s policy had defined PII to include these types of information. Hmm…
Organizations need to formally define PII, and then carefully consider how their information security and privacy policies restrict or allow the disclosure of PII.
Tags: awareness and training, congress, data protection law, FERPA, government, Information Security, IT compliance, personally identifiable information, PII, policies and procedures, privacy, privacy law, risk management, security law, security training, University of Tennessee at Knoxville