This summary article is intended to help every-day users of EMP have a broader understanding of related data privacy issues, but in no ways is intended to be construed as exhaustive, conclusive or any form of legal advice.
Data privacy & security have become a forefront global issue, particularly in the wake of incidents like Cambridge Analytica's use of Facebook data and Experian's data breach of millions of personal identities, but the legal requirements and standards are still evolving rapidly to catch up, leading to much confusion and misinformation on how organizations, particularly higher education institutions, need to respond.
___________________________________________
What are the Data Privacy standards?
There is no global standard for information/data privacy, but two of the most recent, and far-reaching, standards are GDPR and CCPA
General Data Privacy Regulation (effective May 25, 2018)
The GDPR defined new guidelines for any organization seeking to collect and process personal information of individuals who reside in the European Union. It included a "Bill of Rights" for EU residents, including the:
Right to be informed;
Right of access;
Right to rectification;
Right to erasure/to be forgotten;
Right to restrict processing,
Right to data portability;
Right to object; and
Rights in relation to automated decision making and profiling. Read more on iapp.org...
California Consumer Privacy Act of 2018 (effective Jan. 1, 2020)
The CCPA has been referred to as California's GDPR, as it is also a comprehensive law to protect the personal information of California “residents” (essentially those considered taxpayers under state law). One key difference is its limit of coverage to information collected by companies that do business for profit in California. Thus, most not-for-profit colleges and universities are believed to be exempt from the CCPA. However, due to some ambiguity on the definition of "for profit" and the treatment of their for-profit vendors, many colleges and universities are seeking to understand and adhere to the requirements of CCPA as much as possible. Read more on iapp.org...
___________________________________________
What does EMP capture from students?
Email Activity
In order to provide marketers with sufficient detail to provide engaging, relevant email content, several interactions are tracked for every email sent from EMP, with most details available on each Student's Interaction Timeline (Title & Timestamp). Other tracked values are stored for use in supporting metrics (Useragent) or tracking identification (Email ID, Tracking Pixel ID, etc.).
Sent: Email address, Email subject, Email body, Status, Timestamp
Open: Email ID, Tracking Pixel ID, Useragent (full string), Email Client, Operating System
Click: Email ID, Link Tracking ID, Link Destination, Useragent (full string), Email Client, Operating System
Replies: Email ID, Email address, Inbound Email Conversation ID, Useragent (full string), Email Client, Operating System
Opt Out: Email ID, Email address, Opt Out Reason
MyViewbook (PURL) Activity
In order to provide recruiters with accurate detail to understand what actions a student has taken in their Personal MyViewbook site (PURL), EMP captures several data points on each page, with most details available on each Student's Information page (Page Hits, Checklists, Forms). Other tracked values are used for supporting metrics (Payments, Useragent) or security/compliance (Logins, IP Address, GDPR Status).
Page hit: Page name, PURL, Timestamp
Logins: PURL, Password, Timestamp
Link Clicks: Destination, Timestamp
Checklist Item: Status
Forms: Form name, Form Field Values, Submission Timestamp
Payments: Amount, Vendor Transaction ID, Timestamp
Useragent: full string
IP Address: full IP
GDPR Tracking Opt In: Status, Timestamp
External PURL Tracking
Additionally, schools can have their own external web tracking codes, such as Google Analytics or Tag Manager, included on all, or a subset, of their EMP-hosted webpages, including inquiry forms and PURL pages. Schools should ensure that any custom tracking adheres to their public privacy policy.
___________________________________________
How does EMP respect students' privacy?
Keeping Data Private
EMP has taken numerous steps to help schools ensure that only the right people have access to the proper amount of information at all times.
Permissioned Field Categories: Each group of users has the set of fields that they can view, edit or export defined explicitly. They will never see data that wasn't specifically granted to them.
Secure File Transport Protocols (SFTP): EMP encourages the use of SFTP sites to transfer student data files, with built-in integrations for pulling in import files and delivering exported files. Permissions can be granted to the directory-level and then exposed in EMP under the Transports feature in Settings.
Additionally, EMP has given schools the ability to secure content seen on and submitted through the MyViewbook sites by students:
Secure Pages (HTTPS): We recommend setting up all of your EMP-hosted pages to use HTTPS instead of the unsecured HTTP. This does require some coordination with your web/IT team, so please contact your CSM for the proper information and guidelines.
Authenticated Pages: EMP also allows any individual page to be set to "Require a login" that is activated through the student's known email address/phone number and subsequently authenticated based on a student-defined password. The content of the page cannot be viewed or interacted with until a successful login occurs, with a password reset available to their known email address/phone numbers.
For more information on our cloud storage data security, including their most recent SOC1 or SOC2 reports, please contact your CSM.
Respecting Communication Preferences
Beyond respecting the confidentiality of personal information, EMP enforces the proper usage of that data by including a rigorous Opt In/Out process to help schools not accidentally run afoul of regulations.
Opt Out - Email: Every email sent from EMP will have an Opt Out link that directs the student to a form requesting the reason for the Opt Out. From that point on, emails cannot be sent to that student from EMP (without direct intervention from your CSM team in the event of a mistake). The Opted Out status for that email address will be displayed on the Student's Information page and within the Deduplication screen. A full list of Opt Outs can be accessed and exported from the Settings screen.
Opt In - Phone: Any phone communication (Text, Voice) from EMP can only be sent to Opted In numbers. Schools have the ability to Request an Opt In for any Phone Number field on a form (Inquiry Form, Custom PURL Form) for students to directly check a box to receive phone communications. Additionally, schools can upload a list of phone numbers to be Opted In, but they must certify to have a record of those Opt Ins (such as on a paper Inquiry card, or separate Application Form).
Opt Out - Text: Every text message sent from EMP includes instructions for the Student to Opt Out (Text STOP). From that point on, phone communications (voice, text) cannot be sent to that student from EMP. The Opted Out status for that phone number will be displayed on the Student's Information page and within the Deduplication screen. A full list of Opt Outs can be accessed and exported from the Settings screen.
___________________________________________
What does EMP do about GDPR ?
As a processor of student data for schools, EMP does not have a direct relationship with those individuals from the EU covered by GDPR in each school's account, but instead supports schools' efforts to be GDPR-compliant in two additional ways beyond the items listed in "How does EMP respect students' privacy?":
Data Removal Requests (The right to erasure/be forgotten)
As stated above, EMP is not responsible for collecting and managing GDPR requests from GDPR-protected students, but schools should ensure that they have a proper mechanism for collecting and handling GDPR requests from students, along with clear instructions for students on their website (often is placed inside the Privacy Policy).
Upon receiving a valid Data Deletion request, schools must ensure that the student's data is removed/anonymized from all systems they operate and by all vendors they use. In EMP, schools can submit a Data Deletion or other GDPR request through the Submit a Ticket feature (with a type of "GDPR Data Deletion Request") and it will be expedited by our support team.
Web Tracking Opt-In
A GDPR notice verifies the student understands how his/her data is being used, certifies the student is over 16, and the student accepts the school's privacy policy. The GDPR notice will display before going to any EMP-hosted page (inquiry forms, PURLs, microsite pages, SEM forms, Application/secure pages, PSN, etc). Each school can decide whether to make this notice display for only European Union visitors (those with an IP address located in the EU) or ALL visitors (regardless of location).
___________________________________________
What are some general data-privacy best practices?
Compliant Privacy Policy
Per the EMP Acceptable Use Policy, every school using EMP is required to have a compliant privacy in place to be linked to on all hosted web pages. Usually schools have a single institutional Privacy Policy that they update to reflect the breadth of all of their current and intended activities. Those using EMP usually review a number of topics to address/update in that central policy, such as:
Data Collection - Does the Policy cover the types of data the school intends to collect through EMP?
Tracking - Does the Policy cover the various types of tracking that EMP supports (see above section, "What Does EMP Capture From Students?")?
Communication - Does the Policy outline the methods of communication it may engage in from the EMP (Email, Print, Text, Voice, Digital Ads)?
Opt Out - Does the Policy clearly state how individuals may opt out of communications?
GDPR Request Process - Does the Policy clearly explain the school's process for receiving and responding to GDPR requests?
External Lists/Data (Prospects)
When communicating with contacts who originated from an external source, such as test-takers or interest lists, it is imperative to adhere to the permissible communications imposed by the data source and to introduce yourself to the audience as clearly as possible.
Respect usage policies - every source that provides contact information to you will set limits on what can be done with the data (such as prohibiting re-selling, sharing, etc.) and what communications are acceptable (type of messaging, frequency, expiration date, etc.). With EMP's Source tracking, you can keep track of these different lists and take the necessary actions, like archiving a set of Prospects after the 6 month contact window closed, to stay compliant.
Introduce with the data source - let the Prospect students know where you received their information, and why you believe they may be interested in your school/program. Students see a lot of "spam" cross their inbox - don't let them wrongly assume the same of your emails!
Set clear expectations - tell Prospects how you intend to communicate with them in the future, including the type of content that you will send and the general frequency that they can expect. Students receive myriad emails each day, but it doesn't take much to start building a relationship through simple expectations.