CSCU Guidelines for Recording Online Meetings with Employees

1 | Page

CSCU Data Privacy Office: Guidelines for Recording Online Meetings with Employees

This guidance provides information for CSCU employees who are organizing online meetings. Online

meetings include any meeting that is recorded using tools like Microsoft Teams, WebEx and Zoom. It

excludes classroom recordings or meetings for Board of Regents committees, which have established

processes. The guidance supports and is within the bounds of CSCU’s Electronic Communications Policy

(PDF) https://www.ct.edu/files/it/BOR_IT-002.pdf and the CSCU’s Electronic Monitoring and Acceptable

Use Policy (PDF), https://www.ct.edu/files/it/BOR_IT-001.pdf . The terms of CSCU policy shall prevail if

there are differences in approach.

I. Purpose

This guidance is intended to provide related support for CSCU employees organizing or participating in

non-classroom virtual meetings. It does not cover all scenarios and options; rather, it provides

direction and best practices for maintaining privacy prior to and during employee-organized online

meetings. For guidance regarding the virtual learning environment with students, review FERPA &

Virtual Learning: https://www.ct.edu/files/pdfs/FERPA%20and%20Virtual%20Learning%209.3.2020.pdf

II. Should my meeting be recorded?

Meetings should not be recorded unless there is an explicit reason to do so. It is the responsibility of

the meeting organizer or relevant leader to make and communicate this determination to meeting

invitees. Recordings may be subject to the Freedom of Information Act (FOIA), record retention law,

and privacy requirements.

A. Identify the purpose for recording.

Consider whether supplying the slide deck, minutes, notes, or a briefing of the meeting would be

sufficient for those who are unable to attend. What is the reason a recording needs to be made? Is a

transcript necessary? Document purposes so you can notify the attendees ahead about why you need

to record the meeting.

B. Consider whether communication might be stifled if attendees are recorded.

If individual attendees are likely to self-censure their engagement, then recording the meeting may be

detrimental. Consider whether recording the meeting might restrict participation.

C. Consider whether sensitive or protected data will be discussed or viewed during the

meeting.

CSCU cannot completely secure meeting recordings because the links to recordings are readily accessed

and shared. Therefore, meetings should not be recorded if sensitive or restricted information about

individuals is expected to be shared visually or verbally during the meeting. Sensitive information

pertains to one or more specific individuals and carries an invasion of personal privacy and/or risk of

harm if it were to become public. The concept includes all data classified as DCL2 or DCL3 according to

CSCU’s Data management Policy (IT-STND-001). Harm includes all levels of injury from embarrassment

through significant physical and financial harm. If identifiable student education record data is to be

visually or verbally shared, then the meeting should not be recorded. It is also important to remember

that documents and recordings, including employee emails, maintained by CSCU institutions are subject

to public disclosure under FOIA, unless an applicable exemption or exception, or privilege applies.

2 | Page

CSCU Data Privacy Office: Guidelines for Recording Online Meetings with Employees

III. My meeting needs to be recorded. Now what?

What should I communicate to the attendees

if the meeting is to be recorded

Online meetings are subject to laws that protect individual privacy or may require consent prior to

recording. The meeting organizer who needs to record a meeting should seek the informed consent of

all participants who will be recorded. Informed consent includes receiving notification about the

purpose for recording the meeting, plans for sharing or distribution, and providing either explicit or

implied consent to have the recording used for that purpose. “Explicit consent requires the participants

to express their consent to be recorded; implied consent assumes the participant is consenting to the

recording if there is an overt indication that the meeting is being recorded.”

Many meeting organizers

rely on the built-in notification that some tools employ; however, these typically only state that the

meeting is being recorded without providing information about why the recording is necessary or

whether the recording will be shared with non-meeting attendees. These facts can be provided

verbally at the start of a meeting before recording begins; however, a best practice is to inform

potential attendees in advance of the meeting (preferably within the text of the meeting invitation).

Let invitees know that:

1. the meeting will be recorded and, if applicable, an accessible transcript or captioned video will be

created.

2. the reason(s) why the meeting will be recorded and the plan for use of the recording and/or

accessible transcript including where to access the recorded material.

3. if individuals do not have an obligation to appear or speak in the recording, offer alternative

options for participation. For example, participants might leave their cameras off and participate in

listen only mode, if the convener is informed in advance.

4. by participating in the recorded meeting in an identifiable way, the attendee authorizes the use of

the recording and transcript (if applicable) as described.

Do you need consent from the participants to share the recording?

It is a best practice to provide notice of recording prior to the meeting. In some instances,

obtaining

consent before sharing meeting recordings and transcripts with external non-meeting participants is

legally required. If the meeting includes video or audio recording of presenters/speakers who are not

CSCU employees (e.g., presenters or panelists from another organization), it is essential for non-CSCU

employee presenters/speakers to sign a speaker agreement. For CSCU employees who will be recorded,

it is a best practice to provide notice and to obtain consent before recording and releasing recorded

material to external non-meeting participants. The notice and consent can be provided through email;

however, it should include affirmation that the presenter or participant agrees: 1) to be recorded 2)

what recorded information will be shared, 2) why the recorded information will be shared, 3) with

whom the information will be shared, and 4) that the CSCU employee consents to the sharing of the

recording.

How do I obtain consent for the recorded materials to be shared with non-attendees?

While a signed and dated written consent is the gold standard, this is often not practical, especially

when there is a substantial number of participants. Another approach is to give individuals clear

notification prior to the meeting (e.g., within the meeting invitation or in a separate e-mail message)

that accepting the meeting invitation and participation in the meeting equals consent for the recorded

materials to be posted or shared and with whom. See the section above labeled “What should I

communicate to the participants if the meeting is to be recorded?” Potential attendees with

reservations about the recording have the responsibility to indicate this by alerting the meeting

organizer of any reservations or a need for accommodations. The meeting organizer can retain copies

of the e-mail acceptances as verification. The organizer could also seek affirmation of consent at the

beginning of a meeting through the meeting chat feature or verbally; however, waiting until this point

3 | Page

CSCU Data Privacy Office: Guidelines for Recording Online Meetings with Employees

is not a best practice. Once the meeting has started, individuals may not be aware of their options and

may feel pressured to continue engagement rather than voice public dissent.

What considerations need to be made for Accessibility?

Meeting presenters/speakers or attendees, who require reasonable accommodations or workplace

adjustments, have the primary responsibility to notify the meeting organizer prior to the meeting so

that the organizer may consider the specific request and make appropriate adjustments to provide all

participants an equal opportunity to participate. When the recording is intended to be shared with a

broad audience or with the public, and/or the recorded content will be posted on an external-facing

CSCU website, closed captioning or video transcriptions are required. These materials may be useful:

o CSCU Digital Accessibility (especially, see Section 1.2)

o ADA.gov State and Local Governments

o Accessible Information Exchange: Meeting on a Level Playing Field

o U.S. Laws for Video Accessibility: ADA, Section 508, CVAA, and FCC Mandates

o Transcripts: In Making Audio and Video Media Accessible

How can I minimize the likelihood that individual data about students will be recorded?

- Require presenters to provide presentation material in advance so that it can be reviewed for

sensitive or restricted data.

- Remind presenters to close unnecessary applications on their computer before screen sharing.

- Do not share screens when applications that contain personal information such as Banner and

other applications located in the Protective Enclave are on screen.

What else should I consider?

Consider these when planning your meeting.

- Do not use the “Record Automatically” setting.

- Allow participants to stay off camera if they desire privacy but want to engage in the meeting.

- Presenters can choose to “Share a window” instead of “Share a screen” via Share Content to

minimize the likelihood that information background applications will be revealed.

- Only share meeting recordings with those identified in the notification to the meeting attendees.

- Verify the permission settings on the recording file for editing and downloading capability.

- Avoid downloading recorded meetings to a location outside the Microsoft O365 environment

whenever possible so recordings remain protected by CSCU security controls.

- Consider the NIST cybersecurity standards document: Preventing Eavesdropping and Protecting

Privacy on Virtual Meetings. https://www.nist.gov/blogs/cybersecurity-insights/preventing-

eavesdropping-and-protecting-privacy-virtual-meetings

IV. Does FERPA apply?

If the meeting does not include students or personally identifiable information of students (“PII”), then

the recording of the meeting is not subject to the Family Educational Rights and Privacy Act (“FERPA”).

If the meeting includes students who are working for a CSCU institution (e.g., library student workers),

and the meeting does not pertain to the student-workers’ academic experience, then the recording of

the meeting is not subject to FERPA because the student is deemed an employee of the CSCU

institution and the recording will not be a part of the student’s education record. However, if

identifiable student education records are exposed so that they are recorded (verbally or visually), then

FERPA applies and access to the recorded material must be restricted. As a rule, FERPA-protected

student education records should not be shared or accessed by CSCU employees unless the individuals

are authorized as “School Officials” and have a legitimate educational reason to access the student

education records

. A best practice is to not record the meeting if identifiable student education

records will be shared or discussed during the meeting.

4 | Page

CSCU Data Privacy Office: Guidelines for Recording Online Meetings with Employees

V. Notes & References

The term “attendee” is used interchangeably with “participant.”

Harvard University Information Technology, “General Considerations for Recording and Saving

Transcripts of Zoom Meetings”, March 01, 2022, https://harvard.service-

now.com/ithelp?id=kb_article&sys_id=6880408bdbab8c9430ed1dca489619bc

Heritage Law, “The Legalities of Recording Video Conferences”, March 22, 2021,

https://www.heritagelaw.com/blog/legalities-recording-video-conferences/

Reporters committee for Freedom of the Press, “Connecticut: Reporter’s Recording Guide,” October

2019, https://www.rcfp.org/reporters-recording-guide/connecticut/

See CSCU FERPA Notice and Directory Information Policy for more information regarding the definition of a

“School Official” https://www.ct.edu/files/policies/2.2%20FERPA%20and%20Directory%20Info.pdf