Personal Data Left Out in Open Box

An open box containing thousands of old coursepack order forms—with students’ names, Harvard ID numbers and some credit card numbers—was left unattended in the Science Center basement Saturday.

The box, which was left across from the room-—currently under rennovation—that Harvard Printing and Publication Services (HPPS) uses each semester to distribute coursepacks, contained copies of coursepack order forms from the Fall 2002 semester.

The box was removed soon after The Crimson notified the Harvard University Police Department of its presence on Saturday afternoon.

Two Harvard spokespeople were unable to comment yesterday on whether leaving the materials unattended constituted a violation of student privacy.

Spokesperson Robert Mitchell did not know how long the box had been left unattended.

HPPS Director Joanne Silva could not be reached for comment this weekend.

Attorney Harvey A. Silverglate, who co-founded the non-profit Foundation for Individual Rights in Education (FIRE), said that if the University is responsible for leaving the box accessible, it may be legally negligent.

“If somebody were to get that information and use the credit cards fraudulently, we’re not talking...here about a violation of privacy,” Silverglate said. “We’re talking old-fashioned negligence.”

Greg Lukianoff, the director of legal and public advocacy for FIRE, said that making the information on the order forms public would probably not qualify as a privacy violation.

“It’s something that Harvard should be embarrassed about but not necessarily a FERPA [Family Educational Rights and Privacy Act] violation,” Lukianoff said.

He added that ID numbers and the list of classes for which students ordered coursepacks would probably not be considered part of a student’s confidential educational record, which FERPA prohibits a school from disclosing.

Students whose order forms were in the box said they were not overly concerned about the potential loss of privacy.

“It’s mildly disturbing,” said Sarah M. Fine ’05, whose coursepack order form was in the box. “It’s not a big deal, for me at least.”

Theodore T. Ashley ’06 said that he had never had a problem with Harvard’s privacy protection measures and was not particularly worried that his credit card number was openly available in the Science Center.

“If someone steals it from there, Visa could pay it off,” Ashley said. “It’s still kind of a rash and careless thing to do on Harvard’s part.”

—Staff writer Joshua D. Gottlieb can be reached at jdgottl@fas.harvard.edu.