Message Regarding Data Analytics Pilot Project

Dear Members of the George Washington University Community,

I write to inform you of a data analytics pilot project that took place on the university campus during the Fall 2021 semester, and to apologize on behalf of the university for the failure to inform you in advance of commencing this project.

During the Fall of 2021, GW Information Technology (GWIT), in conjunction with the Division of Safety and Facilities and the Division of Student Affairs, used locational data from Cisco WiFi access points across GW campuses to construct dashboards that could be used to determine density and use of buildings by students, faculty, and staff in the aggregate in order to assess how this could help inform the Safety and Facilities team’s operational priorities.  In addition, student-connected device locational data was merged with additional de-identified student data for use by the Division of Student Affairs to assess capabilities for providing insights into the utilization rates of various campus facilities by broad segments of the student population.  This pilot project was concluded in December 2021.  

I was informed of this project shortly after my arrival in January 2022.  I also learned that an article was posted suggesting that a similar project had been launched previously in the law school in 2019.  I want to make it clear that although there was discussion of such a project, the project did not take place.  The article also implied that GWIT, in the Fall 2021 data analytics pilot project, analyzed individualized data of each individual.  I want to make clear that this also did not happen.  However, I understand that the aggregated and de-identified data for student space utilization dashboards, which were included in the Fall 2021 data analytics pilot, did include additional descriptors, such as gender, in order to analyze the use of our campus facilities.

The privacy of our GW community members was of utmost importance to this pilot.  The data included in the heat maps for space utilization and dashboards for student utilization for certain spaces was aggregated and de-identified.  However, as noted above, GWIT did attach descriptors to the data, so it was not completely anonymized.  I want to be clear that even though the technical capacity may exist to track individuals across our campus, such a capacity was not utilized nor contemplated in this pilot and no individualized data tracking or movement across our campus was ever shared.  Regrettably, however, the university neglected to inform members of our community in advance of commencing this analytical project.

The collection and use of such aggregated data raises important privacy considerations and potential breaches of expected ethical norms in higher education, and I recognize the need to address whether and how such data collection and analysis should occur in the future.  Moving forward, I have tasked the Provost to convene a policy committee comprising students, faculty and staff to develop a university position and policy, or set of policies, governing the use of university data for analytics as well as guidelines regarding required notifications and appropriate consent and authorization of those whose data is being collected.  I have asked the Provost to charge this committee with establishing policy details governing the use of student, faculty, and staff data for analytical purposes, but also with establishing protocols to ensure that the privacy policies and guidelines of the university are upheld.  The work of this committee will be managed by Terry Murphy, Senior Vice Provost for Academic Affairs, and Jared Johnson, Interim Chief Technology Officer.  In the meantime, any data collected and aggregated during the 2021 planning and pilot efforts in connection with this project that has not already been destroyed will be destroyed and no similar efforts will be undertaken until there is policy guidance that is adopted and fully communicated to the university community.

The university is committed to maintaining the privacy of all personal information.  Throughout the performance of university operations, the university continues to safeguard the generation, collection, use, storage, disposal, and disclosure of personal information in accordance with our policies, best practices and as required by applicable laws and regulations.  The university deeply regrets that this project took place without proper review or safeguards and we will work to make sure that such an incident is not repeated.

Sincerely yours,

Mark S. Wrighton
President