Educause Security Discussion mailing list archives

Re: Legal Compliance and Marketscore and Higher Ed


From: Tracy Mitrano <tbm3 () CORNELL EDU>
Date: Fri, 7 Jan 2005 17:49:19 -0500

 Does it improve our liability and compliance picture, if
someone still exposes the university through carelessness.

Jim

Short answer, no, unless the *contract* was found to be unconscionable..

Let's play with the scenario:  Employee acts as agent for
institution, makes contract with MarketScore...if it were to be found
by a court (or in the case of FERPA, an administrative proceeding)
that they acted outside the scope of their employment they might also
lose institutional indemnity, perhaps their job (especially if warned
or prohibited by policy to engage in relationship) and could
conceivably be personally liable for damages in the event of a
disclosure, say, of medical or financial records (along with
MarketScore, incidentally, since they promise in the contract to
protect the personal information).

The institution may or may not be liable, depending on how the
"respondent superior" (vicarious liability in employment law) plays
out at trial, but with deep pockets and precedent in favor of finding
for institutional liability except in the most egregious "ultra
vires" cases I sure would not be cavalier on that account either.

Tracy

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.

Current thread: