Effective immediately the campus will no longer support the use of Otter.ai for meeting transcription due to data privacy concerns. Both Microsoft Teams and Zoom have the ability to do meeting transcription as an alternative.
The product Otter.ai captures live transcriptions from meetings and performs analysis of those transcriptions. This is a useful service which many members of our community have decided to adopt in their campus work. Use of Otter.ai unfortunately results in campus employees sending campus information to a third party (Otter.ai) without any contracts or agreements in place with the University to meet legal and regulatory requirements of the University, SUNY, and New York State. Services which receive and process campus data are required to go through the campus purchasing process for this and other reasons.
We are restricting the use of this application because it was adopted without a campus agreement or contract in place which address the following concerns (and more):
FERPA and GLBA responsibilities: When it’s possible that information related to students is processed by a third party, we require them to formally accept responsibility as a school official. We want people with access to our information to be authorized parties. Authorized by campus contracts or agreements and the people authorized to create those agreements on behalf of the University.
Data Breach responsibilities: Without a contract third parties have no responsibility to notify SUNY Brockport when information about our employees or students is breached. They will also attempt to place breach liability onto the individual or organization providing the data. Legal notification of individuals can require some significant expense and failure to do so can result in legal actions and fines against the responsible party.
NYS Privacy Protection Law and Freedom of Information Law (FOIL): We are sometimes required by law to provide records that we collect or retain about individuals related to their requests or various legal inquiries. That requires us to have a campus relationship with vendors who store and process our campus data and not individual private relationships.
Campus Risk Management: We can reduce the risk to individuals and to the campus of legal or regulatory action against our campus and community by ensuring we have campus level agreements in place with our partners. This allows the resources and authority of the campus (and SUNY/NYS) to be applied to these relationships to ensure our partners fully comply with their responsibilities and that they don’t leave SUNY Brockport holding the bag.
Records Retention: We are required to ensure that information and records which we create are destroyed within certain time frames. We also don’t want third parties to retain our information after we stop using the service, for instance. We may not want a third party to transfer access to a parent company after a merger or after a sale.
Fraud and Identity Theft: When third parties, such as Otter.ai, breach our campus data they make our campus community and their families more vulnerable to financial fraud. We can help create a safer campus by ensuring our vendors are contractually committed to protecting privacy, are capable of immediate breach notification, and operate responsibly.