HB1 — Virginia Code § 23.1-405(C)

Effective July 1, 2018, Virginia Code § 23.1-405(C) prohibits a college or university from disclosing a student’s email address, physical address or telephone number “unless the student affirmatively consented in writing” to the disclosure. For more details about this legislation and its impact on faculty, staff and students, please explore our FAQ below. This page will be updated periodically to provide additional information.


FAQs

What is HB1?

Effective July 1, 2018, Virginia House Bill 1 (HB1) amended Virginia Code section 23.1-405(C) to prohibit a college or university from disclosing a student’s email address, physical address or telephone number unless the student has affirmatively consented in writing to the disclosure.

Why was the statute changed?

Under the Family Educational Rights and Privacy Act (FERPA), certain basic student information, termed “directory information” (e.g., name, address, phone, year in school, major), may be disclosed without student consent. The change in Virginia Law was born out of concerns about protecting student privacy.

FERPA and FOIA allowed businesses and other organizations to obtain student information and send mass, unsolicited texts and emails. The revised statute requires that student contact information may be disclosed only if the student has affirmatively approved the disclosure in writing. Practical and operational consequences of this law may make internal communications more difficult than was likely intended.

What are the key takeaways regarding this statute?

  • This legislation covers students in all academic program levels: undergraduate and master’s.
  • Faculty and staff will continue to have access to contact information for all students; however, they will not be able to disclose that information to any individual other than a College employee without the student’s written consent.
  • Students will no longer be able to find contact information for another student through the College’s online directory (feature of mySBC) or through the College’s email system (Gmail).

What does "consent" under the statute look like?

The consent must be wholly voluntary, in writing and must predate the disclosure. Please note:

  • Consent cannot be implied by virtue of a student’s participation in a class, team or activity; and
  • Consent cannot be required in order to participate in a class, team or activity.

What is the procedure and necessary paperwork to get student consent?

Please click here for more information.

How can faculty and staff access student contact information?

We removed access to student directory information from the online directory (feature of mySBC). Access to that information is now given out only to faculty and staff on a need to know basis. The mass email capability in mySBC was changed to blind copy students, so that they could not see other students email addresses.

Faculty will retain access to student and class roster information in Canvas and mySBC.

Will faculty have access to student email addresses for students not enrolled in one of their courses?

No. Faculty members will have access to contact information for their students only through Canvas and mySBC.

Can faculty and staff provide student contact information to another student?

Unless a student has provided affirmative written consent for the disclosure, faculty and staff members may not disclose student contact information — email address, phone number or physical address — to any individual who is not a College employee.

Can faculty and staff who coach teams or advise student organizations provide student contact information to other students on the team or in the organization?

Faculty and staff may not distribute a team or organization roster that includes student email addresses, phone numbers or physical addresses without written consent from each student whose information is provided.

Will group emails to multiple students be allowed?

Yes, group emails to multiple students are still allowed; however, faculty and staff may not disclose a student’s contact information to another student. So, in order to email a group of students, the sender must add the students’ email addresses in the “bcc” field, not the “to” or “cc” field. Please note: personal email groups and group contact lists created by faculty and staff in Gmail do not protect the privacy of student email addresses. An email sent via an email group or contact list created in Gmail will show the email addresses of all members of the group when it is received, and therefore must not be used unless all recipients have provided written consent.

What method can faculty and staff use to contact students?

The statute does not affect how faculty and staff contact students. Emails, phone calls, Canvas and in-person communications can still be used to interact with students. Faculty and staff members must take precautions, however, when using student contact information; without written consent from the student, faculty and staff members may not disclose a student’s email address, physical address or phone number to another student or a non-College employee.

How will the display of student information in Canvas be handled?

While the statute does not place restrictions on employees’ access to student contact information, it does prohibit disclosure of student contact information to other students. As such, class rosters with email addresses and/or phone numbers may not be made available to students. It is important that students not be able to access their classmates’ email addresses through Canvas. Students are able to contact their classmates directly through Canvas without access to student email information.

What about when students are working together in groups?

If students are working in teams, they must exchange contact information among themselves. Absent written consent, faculty may not provide student contact information to another student.

They may also use Canvas to communicate with one another, which uses internal messaging without access to student email information.

What about blogs used in classes?

College faculty and staff members may not disclose student contact information without affirmative written consent, regardless of the media used to publish or disclose the information.

There are student workers and student assistants who routinely access the email address, phone number, or physical address of other students as a part of their work. Does their access need to be removed?

No. A student worker or assistant required to access this information as a part of their work duties is considered a “school official” under FERPA with the need to know this information. Student workers and assistants who have access to this information must be made aware that they may not disclose this information to others without supervisory authorization and written consent from the affected students. It is advisable to remind student workers and assistants who access this information that they may not access or use it for any purpose other than as necessary for their assigned work duties.

How does the legislation impact students?

The statute prohibits the College (and its employees, faculty and staff) from disclosing a student’s email address, physical address or telephone number unless the student has affirmatively consented in writing to the disclosure. Student-to-student contact, however, is unaffected by the statute. Students may freely disclose another student’s email address and phone number. The statute’s prohibition relates only to disclosure of this information by the College.

As a student, how do I find out another student's contact information?

You may obtain a classmate’s contact information directly from the classmate or from a list or directory in which your classmate has given the College consent to post their contact information. The College cannot provide you with another student’s contact information unless that student has consented to the disclosure.

You may also use Canvas to contact another student you share a course with without knowing or learning their email address.

As a student, am I able to send group emails to other students?

The law restricts disclosure by the College but does not restrict any disclosure by students or others of information they lawfully possess. For example, if students in a student organization or club collect and distribute membership rosters, that disclosure is not restricted by this law. However, the College may no longer provide the contact information for these group rosters. As a best practice, we encourage students to seek permission, or permit objections, before publishing the contact information of others.