Students' GPAs leaked in mass email
The personal information of 570 students was inadvertently leaked on Tuesday, March 22, when a spreadsheet containing the information was mistakenly attached to a mass email for the Lee Foundation Scholarship. The spreadsheet contained information for students in the School of Engineering with GPAs above 2.80 who have sophomore or junior credit standing.
At 9:59 am, those 570 students received an email with the subject line “Welcome to list leefoundationscholarship” notifying them that they had been added to the email list leefoundationscholarship@lists.rpi.edu. The email included a link to the list’s Sympa homepage. Sympa is the service that is used to host and manage RPI mailing lists. As of Thursday, March 24 the homepage listed the number of members of the list at 570 but by the time of publication the list had been removed from Sympa.
At 10:02 am on Tuesday, students on the mailing list received an email with the subject line “FW: Patrick P. Lee Foundation Scholarship - Invitation to Apply.” The email states that “The Lee Foundation Scholarships provides financial support to undergraduate students pursuing degrees in Engineering at Rensselaer.” The $12,500 scholarship is granted to four students to be used towards tuition and room and board. The email then lists the criteria for scholarship consideration:
- Students who will be juniors or seniors in academic year 2022-23
- Pursuing a degree in Rensselaer School of Engineering
- Cumulative grade point average of 2.8 or greater
- Compelling personal statement
- Financial need* - Expected Family Contribution (EFC) $10,000-$50,000
The email, which is signed by Associate Dean for Academic Affairs of the School of Engineering Dr. Matt Oehlschaegar, was forwarded to the email list by School of Engineering Student Services Manager Dana Chichester. Attached to the email was an Excel spreadsheet titled “Lee foundation candidates revised.xlsx” which contained the names and personal information of the 570 students. The spreadsheet had been used to determine eligibility for the scholarship and form the email list, according to an apology email that was sent to students on March 24. The spreadsheet contained 16 columns of information, including students' full names, RINs, RPI emails, citizenship statuses, overall GPAs, and credit hours earned. All students in the spreadsheet matched the criteria for bullets 1-3 in the email. A complete list of the columns can be seen below.
At noon, nearly two hours after the email had been sent, Chichester sent another email to the same list with the subject line “My apologies to all.” In the body of the email she wrote:
“I sincerely apologize to everyone as I did not intend to include the spreadsheet in the email for the Lee Scholarship in any way shape or form. Please delete the spreadsheet from your email.” Below the signature block of the email was the following paragraph:
“This email and any files transmitted may contain confidential information as protected by the Family Educational Right to Privacy Act (FERPA), 20 USC s 1232g and/or Electronic Communications Privacy Act, 18 U.S.C. ss 2510-2521. If you are not the intended recipient you are hereby notified that any disclosure, copying, or distribution is prohibited. If you have received this electronic communication in error please notify me by telephone or return e-mail and delete this message from your system completely.”
This email did not have the spreadsheet attached. This disclaimer regarding FERPA was not found in the email containing the spreadsheet.
Eleven minutes after Chichester’s second email was sent a third email was sent with the subject line “Recall: Patrick P. Lee Foundation Scholarship - Invitation to Apply.” The body of the message reads:
Chicester, Dana M would like to recall the message, ‘Patrick P. Lee Foundation Scholarship - Invitation to Apply’.
After this message was sent, the original email with the spreadsheet attached was no longer available on the institute email service Roundcube, according to multiple students who received the email.
FERPA prevents educational institutions from disclosing various pieces of personal information without students’ consent. FERPA cases can be gray areas at times. While students do not have standing to sue universities over FERPA violations, they can file a complaint with the U.S. Department of Education if your information was disclosed without their consent.
The apology email mentioned earlier can be seen in full below.
