Version: 3

Issued: July 2016

Reference: GEN-DOC-007 (previously published as PB/INFO/081)

Author: A. Cormack

Last Reviewed Date: 18/08/2020

A number of Janet connected organisations have asked whether they are permitted to allocate email addresses under their ‘organisation.ac.uk’ domain to former students (alumni). This factsheet discusses the issues this is likely to raise.

Am I allowed to give alumni ‘ac.uk’ email addresses?

Yes. Giving someone an email address is separate from giving them access to the Janet network. The Janet policies may prohibit you giving alumni access to the network but they do not prevent you giving them email addresses.

What issues should I consider?

All email users can cause problems for the organisation that owns their domain:

• Reputational: if the user engages in activities with which the organisation does not wish to be associated.
• Legal: if the law considers (or if an injured party claims) that the organisation has responsibilities for the user or their actions.
• Technical: if the user’s actions directly or indirectly damage the organisation’s systems; for example other networks may react to inappropriate behaviour by rejecting all mail from the organisation (‘blacklisting’).

However alumni differ from current staff and students in two ways: they may well use email for a wider range of activities, and the organisation has less control over them. Email for alumni is likely to raise the same issues as these other groups but the tools available to address them may differ.

What addresses should I use?

Although it might seem attractive simply to allow students to retain the same email address when they graduate, this has a number of practical problems.

• Many sites use the form of an email address to distinguish staff from students; for example an address may be based on name for staff and on student number for students. Including alumni in the ‘student’ naming system will confuse both staff and students.
• Student email addresses are likely only to be needed for a few years but alumni will want to keep theirs for life so a much larger pool of addresses will be needed. If a name-based form (e.g. John.Smith@example.ac.uk) is used then there will be many more living alumni eligible for the same address than students or staff. Number-based systems that rely on year indicators (e.g. including a ‘1’ for 2011) are also likely to fail for alumni.

Moving alumni to a separate sub-domain (e.g. John.Smith@alumni.example.ac.uk) can help with some of these issues and also, perhaps, clarify for reputational and legal purposes that the person has a different relationship with the organisation. However this raises the question of when students receive their new address. Job applicants will need a permanent email address during their final year, but will the organisation then cancel alumnus addresses for those who fail their exams?

What services might I provide?

‘Providing an email address’ can be done by a number of different services.

Forwarding is the simplest approach: each user simply nominates an external address to which they want mail to be forwarded. The organisation receives mail sent to alumnus addresses and forwards each one as instructed. There is no local mailbox, so support and liability issues may be reduced. However alumni are likely to also want to send mail from their alumnus address, which may be technically challenging.

Outsourcing may let the organisation provide alumni with a mailbox on a public webmail service. These can use the alumnus address for both receiving and sending mail (especially if a separate sub-domain is used) but presumes that suitable contracts are available.

In-house mailboxes are most flexible but also require the greatest support and long-term resources (an alumnus mailbox may well need to be supported for fifty years).

What legal issues are there?

It is important to manage the risks associated with alumni email accounts through clear systems and procedures, which may be similar to existing student and staff policies or processes:

• The content of emails may break either civil (e.g. defamation, copyright) or criminal (e.g. terrorism, harassment) law. Adding corporate templates or footers may make the organisation appear responsible for these. Even if the organisation is not legally responsible, any police or court investigation is likely to involve the owner of the domain name.
• It is possible that you may need to intercept and/or monitor these email accounts regarding the content they are communicating. Alumni should be made aware of the circumstances when interception may occur, such as when legally authorised or required as part of civil or criminal legal action.
• There will also be Data Protection and privacy responsibilities for the organisation to consider as emails are likely to contain personal information. These will be similar to Data Protection procedures for the security, storage and processing of staff or student emails.

What technical issues are there?

Most email systems have similar technical issues; systems for alumni have only minor variations.

• Spam filtering of both in- and outbound mail can reduce the likelihood of the organisation being accused of being a source of spam. Registering with webmail providers’ feedback services can provide an early indication of problems.
• Protecting against mail loops arising from forwarding or auto-replies reduces the risk of a message storm.
• Using different IP addresses for the servers handling mail for alumni should reduce the risk of their activities causing current staff and student mail to be blacklisted: however it may also increase the risk of blacklisting of the alumnus systems.
• If offering local mailboxes, note that there will be many more alumni than students or staff, so storage requirements may be correspondingly greater.

What Terms and Conditions should I apply?

If alumnus mail is carried over Janet then it must abide by the Janet Acceptable Use Policy. Since alumni may not otherwise be covered by this Policy, the agreement for alumnus email addresses should incorporate it. Organisations may wish to add their own acceptable use rules.

Organisations may also wish to include terms to cover possible legal and reputational damage (for example to ensure that alumni are aware of their responsibilities in law and to the organisation providing the email), and to consider how they will deal with complaints or any breach of the agreement (for example by suspending or withdrawing the email service).

Finally, organisations should decide whether they will create e-mail addresses for all alumni or only those who request them; and what, if anything, will be done when accounts are unused and contact with the alumnus is lost. Large numbers of unused accounts will make scaling problems worse, as well as providing more opportunities for misuse, while issuing addresses automatically rather than on request may make it hard to enforce any agreement.

For more information

Jisc Legal Hosting Liability Guidance