Subject: Sharing/posting student information (names, photos, email, field of study, courses, etc.) on department websites or other means.

Purpose: This notice describes how to comply with University policies in regard to sharing/posting student information on department websites and other means.

Details: Departments often share/post graduate and undergraduate student photos and information on their websites and other means (e.g., performance programs/brochures). While this is an effective way to help build a department network and publicize activities and accomplishments, departments must verify the information posted complies with the University FERPA Policy and the Restricted Information Policy.

Student information that falls within the University FERPA Policy’s definition of Directory Information (e.g., name, photo, email address, and major field of study) may be disclosed to third parties without the written consent of the student. However, students can restrict the release of Directory Information to third parties by initiating a directory block in the Banner self-service web portal. Student information that does not fall within the definition of Directory Information generally may not be disclosed to third parties without the written consent of the student.

Implications of a student invoking a directory block in Banner include, but are not limited to:

• Student Directory information cannot be posted on a department’s website or shared with third parties by other means unless the student has provided prior written consent.
• The student’s name and email cannot appear in the public People Directory on the Brown website and Gmail address book.

Departments can check for student directory blocks, also called confidentiality flags, by reviewing either the Concentrators and Grad Students report, or any Class List report, in the Cognos Analytic Reporting Tool.

Additionally, all departments must ensure they do not share/post Brown Restricted Information, as defined by the University Policy on the Handling of Brown Restricted Information, which includes, but is not limited to: addresses, driver's license numbers, passport information and credit card numbers.

For more information on this topic please review the University FERPA Policy and the University Policy on the Handling of Brown Restricted Information.

Actions/Responsibilities: Each department is responsible for the content of their website and other material that they produce. Therefore, departments are responsible to ensure their website and other mediums only share appropriate student information by:

1.   Ensuring all student information that is shared/posted complies with the University FERPA Policy.

2.   Verifying a student has not requested a directory block. If a student has a directory block, do not post/share their Directory Information with third parties unless the student provides prior written consent.

3.   Ensuring student information posted/shared complies with the University Policy on the Handling of Brown Restricted Information.

Questions:

• For policy specific questions please use the contact information listed in the related policy.
• For questions on the Cognos Analytic Reporting Tool visit the OIT Service Center or email the Registrar’s Office.
• For FERPA specific legal questions please contact the Office of General Counsel.
• For general compliance questions please contact University Compliance.

Subject: Restriction on the purchase and use of National Defense Authorization Act (NDAA) Fiscal Year 2019, Section 889, prohibited equipment.

Purpose: This notice describes how to comply with University policies and federal laws and regulations, in regard to NDAA FY 2019, Section 889, Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment.

Details: The National Defense Authorization Act (NDAA) Fiscal Year 2019, Section 889, prohibits federal agencies from entering, extending or renewing contracts or awarding grants to universities that provide or use certain telecommunications and surveillance equipment or services.

The federal government is the largest funding source for sponsored research at Brown University. To comply with Section 889, the University may not provide the government or use any equipment, system, or service that uses telecommunications or surveillance equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, from the following companies/entities, as well as any others the government may designate:

Each department’s efforts are essential to comply with Section 889. Thank you for your continued compliance efforts.

Actions/Responsibilities: To ensure the University complies with Section 889 and remains eligible for research contracts and grants from a variety of federal agencies, it takes the following actions:

• The University does not purchase or contract for equipment or services from any of the listed companies, as the list of prohibited equipment and services may be updated by the government, for use on Brown’s campus and/or for use related to Brown University work or activities, including research. This includes Purchasing Card (P-Card) purchases.
• The University does not use any equipment, system, or service that uses telecommunications or surveillance equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, from the listed companies, for Brown University work or activities, including research. Please note, the listed companies may be updated by the government.
• Faculty, researchers and staff must notify their department leadership immediately if any equipment or services provided by these companies is located/used in their work areas, laboratories, offices, classrooms, or other University spaces. Individuals that need to report prohibited equipment to their department leadership should use the Prohibited Equipment Inventory Spreadsheet. Department leadership must send completed spreadsheets to University Compliance as soon as equipment is identified.
• If faculty, researchers, or staff discover Prohibited Equipment/Services during the course of federal contract or grant performance, they must also notify the Brown office managing the contract or grant (e.g., OSP or other relevant office) immediately.

4.   In addition to reporting any equipment or service from listed companies, department leadership must immediately remove and dispose of any of the following equipment from the listed companies if it is discovered: network servers, network switches, routers, hotspots, surveillance cameras and similar equipment or services as well as equipment or services that store substantial amounts of data (i.e., more data than an individual laptop computer could reasonably store).                                                      

• Department leadership will dispose of this equipment according to the Disposition of Brown University Surplus Property Policy.
• If equipment needs to be replaced, the department needs to work with department leadership to replace required items.   The department will not charge a sponsored project twice for the same item. If required items cannot be funded by the department, department leadership will consult with the Office of the Provost or the Office of the EVP for Finance and Administration for options to replace required items.

5.   All employees (faculty, staff & student employees) who review, manage or work on federal contracts and grants will  conduct due diligence to ensure subcontractors, subrecipients, vendors, and other entities are not providing Prohibited Equipment/Services.

Definition of Prohibited Equipment/Services: Telecommunications or surveillance equipment or services that use telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, from the companies listed above.

Frequently Asked Questions:

1.   My department/office/lab is not funded by a federal contract or grant; can we use Prohibited Equipment/Services?

No, the law does not include an exception for internal use unrelated to federal contracting. Therefore, your department/office/lab cannot use Prohibited Equipment/Services.

2.   My department identified Prohibited Equipment that we need replaced; how do we get a replacement?

If equipment must be replaced, the department will need to work with department leadership to replace required items. The department cannot charge a sponsored project twice for the same item. If required items cannot be funded by the department, the Office of the Provost or the Office of the Executive Vice President for Finance and Administration should be consulted for options to replace required items.

3.   I have a personal cell phone or laptop that is made by one of the companies listed; can I continue to use it?

Yes, the law does not preclude using a personal device for personal use.

4.   What if I do University work on my personal device?

It is a best practice not to use any devices from listed companies for any University work. For questions about using a device from a listed company, please contact the appropriate office listed in the “Questions” section below.

5.  What should I do if I am unsure if I have a prohibited device?

Report the device using the process set forth above and the appropriate office will follow up with you.

6.   Where can I get more information about these restrictions?

Applicable regulations appear at Federal Acquisition Regulation (FAR), 48 C.F.R. 52.204-24 through -26, and 2 C.F.R. 200.216, 200.471.  If you have questions, please see the "Questions" section below for a list of offices you may contact. Please note that the regulation is subject to change and refinement.

Questions:

• For department specific actions and disposal questions contact the appropriate department leadership.
• For contract and grant questions, please contact the relevant office that oversees/manages the contract or grant (e.g., OSP or other relevant office).
• For general compliance questions please contact your relevant Brown compliance function, such as Division of Research or University Compliance.