STAFF EDITORIAL: More changes on e-privacy

The new draft of Penn's policy on electronic privacy doesn't go far enough in protecting or defining student rights. Such a policy would codify, for the first time, the circumstances under which an administrator could read the e-mail or computer files of a faculty member, student or staff member. Presently, the University can read the electronic communications of any student without even informing him or her of the violation. The principal improvement in the policy over the last three months is in the area of notification. In the first draft of the policy, administrators would only "ordinarily" inform members of the Penn community that their electronic files had been read. Now, officials must do so "as soon as practicable." Such an assurance carries with it the first guarantee that -- exceptional legal circumstances notwithstanding -- no one would be ignorant that a third party had seen his or her e-mail or files. But we do have several objections to the policy as it now stands. The first is that the policy's language is very vague. That a student, professor or staff member will be notified that his or her e-mail has been read "as soon as practicable" does guarantee prompt notification. The policy is also unclear where it states that University officials can access computer accounts upon a "good faith belief" that certain conditions will be met. Furthermore, insofar as the privacy breach is part of an investigation into a potential violation of a law or University policy, administrators should be held to the same "probable cause" standard as regular law enforcement officials. Our other principal reservation is not new. The policy allows a large number of officials to initiate and approve access into an individual's e-mail account, including school deans, the Office of Student Conduct and the Office of Audit and Compliance. We are wary of a prosecutorial office like the OSC having that level of investigative power. In that light, only a school dean should be allowed to approve access to a student's e-mail or computer files. The current draft is worthy in that it will fill a policy void that has existed for far too long. But it should only be treated as a transitional step on the road to a policy that better and more clearly protects privacy rights in the University community.