Scenario: The career center is charged with the collection of first-destination survey data for the university. A report, featuring aggregated data, is compiled and shared with various parties at the institution. The director of the center is contacted by development officers and the director of alumni relations who would like to meet and discuss the results of the first-destination survey.

During the meeting, the development officers indicate that they would each like to receive the raw data from the survey. They would like to use this information to target both the recent graduates themselves as well as the employers of the graduates, as potential donors. The director of alumni relations states that she would like to use this information to update contact information of recent graduates in the alumni database. As officials of the institution, they feel that they should have access to the data that are collected by the career center since the data are essential to other functions of the institution.

The invitation to complete the survey indicates that responses will be kept confidential. The aggregated outcomes are compiled in a report and shared with leadership at the institution. The only data reported publicly indicates the number of degrees conferred and responses that follow the National Association of Colleges and Employers protocols and standards. However, it is not clearly defined if or how the data will be shared with other areas of the institution.

Questions: Who owns the data, and what does it mean for it to be kept confidential?

Is it appropriate for the director of the career center to withhold the raw data from other departments?

Should the career center comply with this request because of the potential increase in alumni engagement, recruiting, and donations to the university?

Is the request allowable since the invitation does not explicitly state to participants who will have access to the data?

Analysis: The director of the career center understands that sharing the data with development and alumni relations colleagues can be beneficial to the institution; however, graduates completed the survey with an expectation of privacy based upon the language set forth in the survey. The invitation to complete the survey does not clearly define who will have access to any personally identifiable student data once the data are collected and states that such information shall remain confidential.

Principles That Apply:

• Principle 4: Comply with laws associated with local, state, and federal entities, including but not limited to Equal Employment Opportunity compliance, immigration, affirmative action, and FERPA.
• Principle 5: Protect confidentiality student information related to professional plans.

Options for Resolution: Given the level of ambiguity in the survey information provided to the students, the career center should be conservative in its review and decline the initial request. If the career center desires to disclose such information in the future, the language in the survey must be changed to define who will be provided access to the results of the survey and the personal data included therein. The following best practices should be considered:

• The career center must determine who owns and who is permitted to have access to the data collected. The career center director must determine if the director has the authority to make this decision, or if institutional policy or procedure allows the data to be made accessible to other university units.
• The career center should consult with general counsel to ensure all possible actions comply with FERPA and all other state, federal, and local laws, statutes, and regulations.
• If the decision is made to share data, the career center should determine if the complete data set or only partial data will be shared. The career center should also consult with the Institutional Review Board (IRB) on best practices for the institution.
• When sharing data, the career center should respond in writing to any student data request from university entities. The written response should specify the following:
  • What data points will be shared and to what individuals or entities;
  • How the data can be use, i.e., the data can only be used in aggregate or cannot be used for direct solicitation/fundraising;
  • The data cannot be disclosed to other university departments or any additional third parties; and
  • Individuals who receive the data will comply with all confidentiality requirements and state, federal, or local laws; statutes; or regulations pertaining to the data disclosures.

Other Considerations: For future years, if determined that the data will be shared, the career center should state in the survey invitation how the data will be used and to whom the data will be potentially disclosed. Terms such as “confidential” and “aggregate” should be defined in layman’s terms. For instance, the following sample statement could be added to the invitation:

How does reporting your post-graduate status help XYZ University?

• First-destination survey outcomes are compiled and shared to help prospective students and their families learn about XYZ University, assess student graduation outcomes, and provide information to accrediting agencies.
• Data from the first-destination survey are confidential within the university and may be shared within the university; such information may be shared in forms including, but not limited to, the aggregate (sum total). Reports to any outside entities will not contain any personally identifiable information.
• Contact information collected through the first-destination survey may also be used to help the university update your contact information for alumni records.

Survey respondents could be given the option to share personally identifiable information with university officials outside the career center. For example, students could be supplied with the following:

I understand that the information I provide will be used in the aggregate to assess graduation outcomes (employment, graduate school, and such) and information may be provided to third parties including, but not limited, to accrediting agencies.

Please indicate below if your information can be used for other XYZ University purposes.

• I do not wish my information to be shared with other university departments, including the Office of Alumni Affairs.
• I consent to my information being shared with university entities, which include, but are not limited to, providing my information with the Office of Alumni Affairs for the sole purpose of sharing of my name, job title, and employer in communications to prospective students and to other alumni. (Note: No salary information will be shared and the information will not be used for fundraising purposes.)

Reviewed and updated by the 2022 Principles for Ethical Professional Practice Committee.