Uni in Private Data Blunder
By: York Vision
University department releases preliminary exam results and personal information of students in a mass email.
Vision has blurred the names of those whose personal details were leaked.
A major privacy breach has accidently released confidential and personal information of students.
A mass email, which named 70 Archaeology students, showed their exam grades and highlighted those with learning disabilities.
Minutes after the data was sent, the department wrote another message asking students to “delete it straight away”.
The personal information named students with dyslexia and showed exam results that have not been finalised. An administrator claimed: “I think I mangled it when saving, so it is meaningless and misleading. I will re-send your anonymised marks.”
University rules say that “only your examination candidate number identifies you until marking has been completed.” But some of the marks which were listed next to candidates’ names have not yet been externally marked.
One 3rd year Archaeology student told Vision: “This was clearly an honest mistake, but it puts some students in a very difficult position and could cause them embarrassment.
“Most people are open about their grades and learning difficulties, but for some people this is a private matter and should have remained so.”
He added: “Now that everyone can see my exam number, none of my results can ever be anonymous.”
The privacy breach has also raised questions over the fairness and anonymity of future marking within the department. It is unclear whether tutors and lecturers will be able to access the data.
The Archaeology Department were contacted by Vision but did not comment on the incident.
But, the administrator who sent the confidential data told students: “Lesson learned – when you download a new version of Excel make sure you check your work carefully. Twice.”
Categories: Front Page • NewsComments Feed: RSS 2.0
Posted: Tuesday, March 9th, 2010 at 11:01 am
Headlines (RSS)
I’m sorry, but the intention of it being displayed shouldn’t matter. You have swathes of the relevant year asking for this screen shot to be taken down, including those directly affected. That should be enough.
You know what I was fine when the email went round I honestly did not care. What has made me angry is that OUR department has been sold out by someone in OUR year. and the person I feel most sorry for is the person who is Dyslexic as now everyone knows thanks to visons pathetic attempt to cover the names
candidate numbers are hardly private, they are put up on most departments notice boards, and you can’t read any of the names!
I do not see the point in this article, this issue had been sorted and forgotten about weeks ago. A wrong attachment was made to an email and was soon corrected. The person concerned has always been lovely and helpful and has been genuinely sorry for the mistake. Most of our year had not even realised had happened in the first place!
I also agree with my fellow third year archaeology students above that this screen shot should be taken down. We are a small department, with small groups and we can tell. For me at least I find that picture damaging to privicy countless times more than the original mistake by spreading it further. Please take it down now, and delete your copy of the screenshot.
I know this, and this is the usual method in Archaeology too. What I disagree with is that the “news” is dated, overblown, and smacks of a witch-hunt.
I agree students have a right to know this. I did not know that this was front page news, and there is no mention in the article (this online version at least) that this is in retaliation to breaches of the Media Charter.
We are just trying to make sure that an individual member of the Administration Dept. is not unjustly singled out for making a rare mistake.
Cheers.
@Eve What’s it matter if some of the people who sent it are third year arch students? and I don’t see how they’ve sold us all out as you dramatically put it!
I think the wealth of comments here give huge credit to the students within the department and their understanding and empathy toward a potentially harmful error.
I think the issue here is that within the department it had already been ‘put to bed’ and by reporting on this, Vision has quite clearly aggravated the situation unnecessarily.
Martin’s clarifications of his sources are helpful and Vision is obviously making every effort to further increase the anonymity of the screenshot.
I understand the nature of printing and that circumstances change at last minute, however, Martin – I do not feel you can justify the presence of this story residing on the front page by highlighting potential YUSU errors, a scapegoat one may suggest.
I also take into consideration numerous people’s points regarding candidate numbers and of these being known only by the students themselves. This may be the case, but you must understand that to see your private data on the front page for all to see would surely make anyone paranoid about how anonymous their candidate number actually is.
It is a shame that it has come to this – especially as all involved and therefore of any relevance here, have forgiven and forgotten (for those that even felt the need to forgive and forget in the first place). Efforts by Vision on their website to further blur the text is appreciated, however the names appearing on the front page must be accredited with an apology I feel.
I agree that the person involved should not be singled out for a witch hunt.
But it seems to be that, far from being sensationalist Vision went out of their way to tone the story down, they say that it was ‘accidently sent documents’ when they could just put ‘sent documents’.
They also quote students as saying that it was an ‘honest mistake’, which they had no need to do.
They also explained that the Archaeology department tried to rectify the mistake straight away, again if it was a witch hunt this wouldn’t be a very good way of doing it.
And in regards to names, I am a 3rd Year Archaeology student and I cannot decipher a single name, but well done to Vision for responding to peoples concerns and blurring the names even more. Hopefully that will appease those who seem to have super human sight.
I think that it is certainly a blunder, yes, but it is not clearly represented how hard the admin staff works in the archaeology department, or any other, i’m guessing. I agree with Adam Cliff, that this article has the scent of a witch hunt. Yes the students were shocked at first, but many of us have completely forgotten about it now – to be honest no one really cares what eveyone got, my opinion listening to the 3rd years is that they are far too buisy with their degrees!! poorly done vision!!
@ Anon: Agreed
completely agree with anon’s comment about the tone of the article. Surely if this were a sensationalist witch hunt there would not be the concern from Vision to highlight that this was an honest mistake. Far from being sensationalist the piece is actually admirably balanced.
Thanks for the clarification Martin, I for one agree with some of the more rational comments here, that the article wasn’t particularly sensationalist.
The story was definitely newsworthy, as it shows that private data of students can be leaked, even if it is a mistake, that is a serious issue, and surely there should be policies in place to stop these mistakes been able to happen.
Also I thought it was interesting what Marting said about YUSU, I imagine if this story had only been inside the paper then it wouldn’t have caused nearly as much upset.
I would perhaps say it was an error in judgement to put this on the front page, due to the fact that it is an old story that only affected a minority of students. This is especially sad as there are several very strong stories in this edition of Vision: the courtyard, rising crime and the Haiti raffle were all very newsworthy stories which may now not get the exposure they deserve.
However, I can understand that Vision was not expecting the kind of response they have had to the story.
To those asking for the image to be taken down, please do think about it, the names are now completely blurred and candidate numbers are completely anonymous so there is no reason for Vision to take it down. It is a good visual aid to the story, I can see why Vision used it, they and YUSU obviously felt it was sufficiently blurred to be published and they have now gone beyond that.
@ Martin
There still remains the fact that at least one of our fellow third years sold us out, as you have direct quotations from the emails that were sent as apologies to just the third years, thus helping to aggravate the situation even further.
The point remains that the situations should just have just been left as it was, there was no reason for anybody (inside or out) to go to Vision, especially in what resulted in a front page article.
I think it is a wonderful show of support how the majority of students have rallied round the department and admin staff over this matter, even going so far as to set up a Facebook group in support of the staff.
What I find appalling, like most who have posted, is Vision putting this story on the front page and using a screenshot of the ‘offending’ attachment. For one thing, the person who sent that attachment, blurred or not, is breaking privacy laws and also doing with intent what was previously done in error. That person should be throughly ashamed of themselves.
Using a dispute with YUSU as an excuse to bump this ‘story’ up to the front page sounds to me, who doesn’t have much of a journalism background, as a lame excuse in the extreme. And please, if only from the online version, REMOVE THE SCREENSHOT!. People who are directly affected by this have asked for it to be removed, and you should respect their wishes. Further blurring is not what was asked for. If you need an image, I can send you one of King’s Manor to replace it.
On the subject of anonymity, someone has already said that one surname can just about be read. That is one surname too many. Again, remove the screenshot. As for the anonymity of the admin responsible for this unfortunate error, they are known within the department and therefore their anonymity has hardly been preserved in this instance.
“To err is human, to forgive divine.” The students forgave the admin weeks ago. This ‘non-story’ has had no benefit whatsoever, merely raking over what should have been forgotten.
Just as an update for anyone who can’t find it.
The group I had going on Facebook (mentioned above) in support of the Archaeology admin staff in this case has been reported and closed down. I don’t know who did it, or why, but Facebook didn’t even tell me anything. It’s just…gone.
The response on here has been ridiculous.
Of course this is a valid story. Even if it is a mistake, the fact that it is possible for an admin member of staff to send out the results of 70 students ‘by accident’ surely suggests there is something wrong with the overall system, and that it could happen again, and next time the students involved may not be quite so forgiving.
Looking at the copy of the paper and the version here, obviously more blurring has occurred, but I couldn’t work out any names and I don’t think anyone else, unless they were really looking for it could either.
@ Nick…
So which part of your above posting validates the story? It was obviously a mistake (why would an admin deliberately send the wrong info to numerous students?), even though you seem to doubt that this was done accidentally. The system has been updated (as mentioned before) and on this occasion the students have been forgiving. This is an old story around the department and dragging it into the light again serves no valid purpose.
It would likely be possible for those in the know (other students and friends of those concerned) to work out some of the names on the list if they so wished. This possibility alone should have weighed against the list being published in any way, and Vision’s further blurring just goes to show they feel their earlier attempts were inadequate. The fact remains, the screenshot should be removed…
@ 1st Year
Of course I accept that it was done by accident, I don’t think a member of staff would send peoples details on purpose. What I was trying to say is that, the fact that by attaching the wrong document, and the click of a button 70 peoples exam results and their names could be released, suggests that the university have a lax attitude to our exam results and their confidentiality, and that if it happened before it could happen again. I believe people have said the admin person was unfamiliar with a software upgrade, but it still remains that the same thing could happen again, despite how familiar you are with the latest version of excel.
As other people have suggested, perhaps some kind of password protection, or warnings on documents that contain sensitive data would protect our data better.
And no it doesn’t suggest they felt it was inadequate, it suggests that they were merely acting to reassure people who felt quite emotional about it.
@ Nick…
Thanks for clarifying your position. Phrases like “Even if it is a mistake…” and ” ‘by accident’ ” from your previous posting made your feelings on the matter unclear.
Archaeology students have been assured that measures to prevent this happening again have been put in place. They may even be the measures you suggest above. The admin in question was quoted in Vision as saying “Lessons learned” and that seems to reassurance enough for the majority of students in the department.
As for Vision “acting to reassure people”, they could do that best by removing the screenshot completely, but on that issue we shall have to agree to disagree.
I do hope the same acceptance of ‘lessons learned’ and the measures that have been put in place to ensure it doesn’t happen again, is applied to your lovely Courtyard expose story.
The administrator in question has been at the department for all the four years I have, and long before as well. This is the only mistake we’ve ever known them make. Vision should not have been forwarded the spreadsheet, which could only have come from a 3rd year, because it contains private information. They certainly should not have published it, even in blurred form.
It seems to me that the University has a very lax attitude to our private data, and this is not attacking the admin involved, the fact that they are so well regarded, experienced and, judging by the responses, very good at their job, suggests that it is far too easy for our personal data to be leaked.
I would be interested to hear from the University what ‘lessons have been learnt’, I fear it may have been left to the unfortunate admin to just make sure they double check things, which is surely not good enough when handling such sensitive data.
There should be a system in place that protects against human error.
While I have great sympathy to the member of the department who sent out this document, I do not believe this Vision article ‘smacks of a witchhunt’
For example, the name of the member of staff who sent the file (which would be very easy to find out, as everybody doing Archaeology knows it) does not appear anywhere in the article, and as mentioned elsewhere on the comments board, it is shown many times that archaeologists were not annoyed, merely concerned, and that everybody accepted this to be ‘an honest mistake’
The head of department has sent an email today claiming that this story should NOT have been published; I couldn’t disagree more. The fact that this leak was accidental does not take away from the fact that from now on I (and every other archaeologist) can very easily check the grades of everybody else in 3rd year.
While this does not bother me (or many other archaeologists), I do know of several students who are very protective of their personal data, and as such, this breech is in the public interest, if only to ensure such a mistake does not happen again.
Edited by moderator according to comment below
— My previous comment should have read ‘The head of department has sent an email today claiming that this story should NOT have been published; —-
one thing i think vision do not understand is that despite blurred names for archaeology students these become easy to work out, particularly the paper version. Also academic staff do not have access to our marks and only ever see a candidate number against a mark, therefore even though the marks were accidently sent to third year students, by putting it in the paper you are allowing people like lecturers or other staff and students to be able to work out names…even my housemate managed to identify someone he works with just by knowing he does archaeology and – some names were more distinctive than others.
i still think vision should remove this screenshot from the website and remove any copies of the paper still being handed out around campus, and apologise to those people featured in the screenshot.
First of all, congrats Vision on a very good front page. I have no idea what everyone else is jabbering on about, archeology made a damaging mistake – and vision reported this. There is nothing wrong with this. Additionally if you say you can identify names from that chart your a wally, even if you say its because you knew the people – surley that means that you were on the bloody mailing list in the first place…
Ralph, are you saying that Archaeology 3rd years are a leper colony that don’t interact with the rest of the university? Because it was only our year that were on that mailing list. I’d also like to add that getting the email doesn’t mean we opened it, in most cases.
Ralph re read my comment, my housemate who is not an archaeologist managed to distinquish one name becuase he worked with someone in my year. 2nd and 1st year archaeologists can recognise names also. we are a tight knit group, we have small year groups of about 70, within out department we all know each other, staff and students, so names can be distinquished. Also not all third years actually ever saw the list, many didnt even open the email as they were very quickly informed not to.
sure print the story…freedom of speech and all that, but printing the screenshot was unecessary…surely a screenshot of the apology email would have sufficed…
@ Natasha: Actually I know a hell of a lot of people who opened it, and quite a few who’ve still got it!
@ Ralph
A damaging mistake? To whom? As is evident from the comments the MAJORITY of people affected dont really seem to concerned. I think the majority of third year archaeologists take more offense at vision’s artical than the original mistake. Vision gives no reassurance, they have no real power or the wherewith all to make any changes. So really to those that sent it out to the media as they were “unhappy” bravo, you have actually achieved nothing! Perhaps going to your departmental head and having a one to one about what can be put in place to stop this happening again would of been far more logical but no evidently the journalistic hacks will be able to sort this one out far better! while the majority of the year remained annoyed that their details have been passed on to a third source!
I totally agree with Charlotte here, the issue is not just the article itself, but the fact that the screen shot was included is a beach of priviacy for those involved. It should be removed immediately to avoid further embarassment.
@ Ralph
I don’t consider myself to be a wally (others may argue the point) and as a first year archaeology student I wasn’t on the mailing list. However, archaeology is a pretty close department, as anybody who has read previous comments on this list will quickly realise, and even I can have a pretty good stab at working out a couple of names on that list. For that reason alone, the screenshot should be taken down.
To this end I have contacted Vision staff directly via the website making my view plain and if it is not removed by the end of today I shall be contacting the Press Complaints Commission directly about it.
Ralph I agree,
The only people who could ever possibly work out anyones full names on the list would be those who were originally sent the e-mail. There is only one persons name I can half work out, and in my opinion he is the only person who has any right to complain, and even then I still think it was in the interest of students to know.
I imagine Vision wish they had blurred the names a little bit more, as the blurring on the image on the web article is definitely sufficient.
I feel this was a very good story, the leaking of students private data is definitely in the public interest to wider students.
@ Will
Curious. You start off by saying you would need to have seen the e-mail to work out any names, then defeat your own argument by saying you can half work one of them out for yourself!
Read my previous comment, and that of Charlotte. We are a close department and everybody knows somebody in each year.
Freedom to print the story is not the issue here any longer, even if the ‘story’ itself is months old. The issue is that screenshot, which however blurred and pixelated, still shows personal candidate information, and is hence a violation of privacy. A photo of King’s Manor, if any image were needed, would have sufficed.
Sorry first year mature student, perhaps I didn’t make myself clear, what I meant was ‘can half work out’ was that if you try very hard and use some guesswork then maybe 2 letters are visible.
2 letters is often enough in such a small department, Will!
those of you who are arguing that the names cannot be worked out are arguing to a pointless end, clearly some of can make them out and no matter how much you tell us we cant…cleary we can…i wont ever write on here those names but i can personally distinquish about 4 or 5 names from the first version ( the one that is in the actual paper version, before vision blurred it further ) so it can be done.
A serious error in judgement has been made by vision here, and it is also one that can be easily rectified.
I agree that Vision could have done a better job of blurring the names, but I would say this is a mistake, rather than a ‘serious error in judgement’, I think that it is a very newsworthy story.
Also as far as I can see, their mistake, not blurring sufficiently, is hardly easily rectified, the damage has been done, in the print copy and nothing can be done about that now.
They have made sure on the web versions that no names are discernible. I defy anyone to work out any names from the images on this website without looking at the print copy.
I do think its a shame that people have got so upset about this, as it detracts from what is otherwise a very worthwhile story.
At the risk of sounding like a stuck record, archaeology is a small-ish department and the third year a smaller section thereof. As a first year, not having got the e-mail or seen the printed copy, I can take a fair guess at a couple of names on that document merely by applying knowledge and logic. And if I can do it, don’t you think the third years will be able to work it out?
As for the ‘story’ being newsworthy, that might have been so, had the story been new. Which is the basic point of NEWs. This happened months ago, was dealt with in house and the majority concerned happy with how it was resolved. Anybody outside the archaeology department who has worries about data protection should contact their specific departments for reassurance that it can’t happen to them, and that their data won’t be spread across some uni-paper and website for all to see.
Given the volume of complaints this has drawn to Vision, plus the fact the Press Complaints Commission have been informed, it is about time the screenshot was now removed…
“Minutes after the data was sent, the department wrote another message asking students to “delete it straight away”.”
That’s almost as clever as the time that the university counselling service sent an email about the footpath outside being closed… with every single student on their books in the CC field… and then an email followed to ask everyone to delete it… also CCd to everyone. Some people shouldn’t be allowed near data of any sort because clearly they’re not intelligent enough to understand data protection!
@ anon
So in your perfect world there is no accounting for human error? This was a one-off, genuine mistake by a very competent and valued member of the admin team of the archaeology department! It is just a shame that one student decided not only to keep the e-mail, but send it to the press, long after the matter was dealt with in-house.
‘mistakes happen’…thats not consolation enough. It doesnt affect you so get back into your boxes and stop trying to defend a stupid, unecessary and damaging mistake. I’m dyslexic. I told the University in confidence about my disability. It’s clear now that this could easily be abused- and where was this meant to go when she sent it? Why arent other forms of disability recorded? Don’t reprimand those who are saying ‘this isnt good enough’ because they’re absolutely right. Lets sing from the same hymn sheet and protect those who are the most vulnerable and who are still discriminated against in the job market and through lack of anonymous marking procedures.
I’m not an archaeology student and I have so far only read up to about comment 60. but here goes.
The idea that this article only affects archaeology students is untrue. The University is supposed to maintain a strict control on the identification of marks, exam papers, essays and the like by nothing other than Exam Candidate number. This ensures there is no discrimination or favouritism. I’m not sure whether names should be found next to results before external marking has been finalized. If this is a breach of the blind marking system that has ramifications for all students and all departments.
Also, the critical mistake here is not the emailing of the results to the archaeology 3rd years and as such I would associate no blame with the administrator in question. The mistake here is the simple fact that this was possible and waiting to happen. the university holds a huge amount of information about us. Is all that protects us from privacy infringement the judgement of the many technicians, administrators and secretary’s the university employs?
Within my department the staff have always been very helpful and supportive. However, we pay good money for our education. Professionalism and competency from the University as a whole are also demanded.
@ not the point, going with your ill thought out theme of “it doesnt affect you so get back into your boxes” Well then evidently it shouldnt even be a vision story as it certianly doesnt affect the majority of the student body. If people had concerns they should raise it with their depart heads/disability services head. How do you think the person feels about having a poorly blured out name (in the newspaper) their candidate number and a big Y in the dyslexic colum for all to see? The head of the dept emailed all those with dylexia apologising and asking, if they had any concerns please raise them. That would of been a far more usefull thing to do rather than trying to sensationalised the issue, as accourding the artical writer the people also approaced national and local news, which really does sweet F.A to help ensure safe guards
Well lots have been said on the matter now, an honest mistake by the department, and a mistake by the newspaper for publishing the picture with the results on.
These are both true, and for the sake of the people involved (thats all the people published in the email, the admin staff and the person who sent the email in the first place) the embarassment should be over and done with now surely.
In relation to what protocols have been put in place to stop this from happening again, this will be discussed not just in the end of term BoS archaeology meetings but in most departments also.
I can honestly say that i actually feel sorry for the person who sent this email into Vision, as they must feel so isolated and disgraced by the department (despite any probable help they have given this person in the past), and they feel the need to make this a university wide issue, when it was done and dusted weeks ago, and maybe should have been a little more diplomatic and spoke to their year reps, who could have then brought this up within departmental meetings.
Just to point out that comment 38 wasn’t me! I made comment 21. This has become a witch hunt against perhaps the most competent member of staff in our department. They deserve our full support and understanding given the pressure they’re under and the amazing job they do for us. Anyone from archaeology slagging them off should be ashamed of themselves.
Moderator: Comment 21 changed to include your surname.Click to rate:
- 
Rating: 0 from 0 votes
‘This has become a witch hunt against perhaps the most competent member of staff in our department. ‘
The actions don’t seem to be those of a competent member of staff.
Comment edited by a moderator
@Anon
Harsh and very untrue. It was one minor mistake. Unless you know what you’re talking about, try not to make sweeping generalisations!
1st year,
it was a joke at mr roberts being a little bit hysterical. i think the term ‘witch hunt’ is slightly more ridiculous when all the paper has done is report on a story of someone’s (perhaps one and only) moment of incompetence. At the end of the day a mistake was made; someone has to be at fault despite however popular they may be.
Comment edited by a moderator
@ Anon
“1st year old gas bag”
So, sweeping generalisations AND personal insults. Makes you sound like a very ‘immature’ student…