George Washington University apologizes for data project monitoring student and staff locations on campus

George Washington University apologized for not informing students, faculty and staff about a data analytics project that monitored their location on campus. (Toni L. Sandys/The Washington Post)

George Washington University interim president Mark S. Wrighton apologized Friday to the campus community for the university’s failure to inform it in advance of a data analytics pilot program that monitored locations — though not individualized data — of students, faculty and staff last fall.

The project, Wrighton wrote in his letter to the campus community, was a combined effort of the school’s IT, student affairs, and safety and facilities divisions that used data collected from Cisco WiFi points across GWU’s campuses “to determine density and use of buildings by students, faculty, and staff in the aggregate in order to assess how this could help inform the Safety and Facilities team’s operational priorities.”

The research also accessed “de-identified student data for use by the Division of Student Affairs to assess capabilities for providing insights into the utilization rates of various campus facilities by broad segments of the student population.”

Wrighton referenced an article that said the project “analyzed individualized data of each individual” and said he wanted to emphasize that did not happen. Although the project did not analyze data about individual students, Wrighton acknowledged that some descriptors, such as gender, were used to analyze how campus facilities were used.

“I want to be clear that even though the technical capacity may exist to track individuals across our campus, such a capacity was not utilized nor contemplated in this pilot and no individualized data tracking or movement across our campus was ever shared,” he wrote. “Regrettably, however, the university neglected to inform members of our community in advance of commencing this analytical project.”

Wrighton, who began his interim term Jan. 1 and will serve for up to 18 months while the university searches for a new president, wrote in his letter that he learned of the project soon after he started. He said the collection and analysis of aggregated data “raises important privacy considerations and potential breaches of expected ethical norms in higher education.”

Any data collected as part of the project that has not already been destroyed will be, university spokesperson Crystal L. Nosal said in an email Saturday.

Harald W. Griesshammer, a GWU professor and faculty senator, said the Faculty Senate has been working closely with Wrighton over the past few days as the information about the data project came to light. He said the president’s letter was “refreshingly candid and thorough” and “made it very clear what happened and that it shouldn’t have happened.”

But, Griesshammer said in an interview Saturday, there are still many questions to be answered.

“Exactly who knew what when? Who signed off on this?” Griesshammer said. “Why did the person who signed off on this for the compliance office not red flag this when it was clearly against stated university policy?”

Nosal declined to answer who originally approved the project and whether that person is still with the university.

Leaders of GWU’s student association did not respond to requests for comment on the disclosure.

Nosal said the university is committed to maintaining the privacy of personal information and will create a committee to assess data analytics on campus. She said no similar effort to last fall’s pilot program will be undertaken until the university puts policies in place and communicates them to the campus.

“The university deeply regrets that this project took place without proper review or safeguards and we will work to make sure that such an incident is not repeated,” Wrighton concluded in his letter.