Email Policy

A. Specific Use Provisions

1. Provision of Email
   1. In support of the University’s mission of instruction, research, and service, University Information Technology Services (UITS) provides University Email Accounts to the following:
      1. Employees.
      2. Emeritus Faculty.
      3. Some classifications of DCCs.
      4. Retirees who opt in to retain their University Email Account.

2. Property of the University

   1. University Email Accounts are provided for the sole use of Employees and other appropriately authorized users to accomplish tasks related to and consistent with the mission of the University. University Email Accounts utilize University computing facilities, resources, and property as those terms are used in University policies and applicable law. University Email Accounts, including email addresses assigned by the University, are the property of the University.

B. Use of Email

1. Email communication is intended to meet the academic and administrative needs of the University and is used to communicate to the University Community regarding official activities.
2. When using email for official University activities, Employees and DCCs are expected to use University Email Accounts.
3. All members of the University Community must follow applicable state and federal laws and regulations governing the appropriate use and confidentiality of Constituent information, such as CAN-SPAM, FERPA, and HIPAA.
4. University Community email addresses are included in the University Campus Phonebook to facilitate communication among the University Community.
5. Employees and DCCs are expected to check their email on a frequent and consistent basis to stay current with University-related communications.
6. The University Community is responsible for using or interacting with University email in a lawful fashion. The University requires individuals who are assigned a University Email Account to compose their email correspondence in a manner that follows standards of professional conduct as outlined in the University Staff Standards of Professional Conduct Policy, Professional Conduct Policy, Classified Staff Rules of Conduct Policy, and Student Worker Rules of Conduct Policy.

C. Terminating Access to Official University Email Account Upon Separation 

1. Employees and DCCs who separate from the University for purposes other than retirement or becoming Emeritus Faculty will lose access to their University Email Account and use of their University email address upon separation.

D. Continuation of University Email Account upon Retirement or Emeritus Status

1. Retirees may opt in to retain use of their University Email Account.
2. Emeritus Faculty automatically retain their University Email Account when granted Emeritus status.

E. Automatic Forwarding of Email

1. To reduce risks to the University, including security and legal risks, University Community members are prohibited from automatically forwarding their email from a University Email Account to a non-University Email Account.

F. Personal Use of University Email

1. University email may be used for incidental personal purposes provided that such use does not:

   1. directly or indirectly interfere with the University operation of computing facilities or email;
   2. interfere with the email user's employment or other obligations to the University; and/or
   3. violate this Policy or any other applicable policy or law, including, but not limited to, the Misuse of University Assets Policy, Conflicts of Interest & Commitment Policy, Nondiscrimination and Anti-Harassment Policy, Political Activity Policy, or copyright laws.

G. Authorized Email Restrictions

1. Email users are required to comply with state and federal laws, University policies, and standards of professional conduct. Access to a University Email Account is a privilege that may be wholly or partially restricted by the University without prior notice and without the consent of the email user when (a) required by and consistent with applicable law or policy; (b) there is a reasonable suspicion that violations of policy or law have occurred or may occur; or (c) required to meet time-dependent, critical operational needs. Such access restrictions are subject to the approval of the appropriate University supervisory or management authority (e.g., department heads, systems managers, etc.). Such access restrictions are not disciplinary actions. Furthermore, the access restrictions provided in this Section are independent of, and operate separately and apart from, the proceedings or disciplinary actions addressed in Section L of this Policy. 

H. Authorized Access and Disclosure

1. The University may permit the inspection, monitoring, or disclosure of email when:
   1. required by or consistent with applicable law or policy, such as Arizona Public Records law (A.R.S. section 39-121, regarding inspection of public records); the Family Educational Rights and Privacy Act (FERPA), regarding access to education records; or any appropriately issued subpoena or court order. The Electronic Communications Privacy Act of 1986 also permits messages stored on University systems to be accessed by authorized personnel in certain circumstances; or
   2. there is a reasonable suspicion that violations of law or University policy occurred or may occur; or
   3. there are time-dependent, critical operational needs of University business if the University determines that the information sought is not more readily available by other means.
2. In such instances, the University will, as a courtesy, attempt to inform email users prior to any inspection, monitoring, or disclosure of email, except when such notification would be detrimental to an investigation of possible violation of law or University policy. Users are required to comply with University requests for access to and copies of emails when access or disclosure is required or allowed by applicable law or policy, regardless of whether such emails reside on a computer housed or owned by the University. Failure to comply with such requests can lead to disciplinary or other legal action pursuant to applicable law or policy, including, but not limited to, appropriate University personnel policies or codes of conduct.

I. Misuse of University Email

1. Using email for illegal activities is strictly prohibited. Illegal use may include, but is not limited to, obscenity; child pornography; threats; harassment; theft; attempting unauthorized access to data or attempting to breach any security measures on any electronic communications system; attempting to intercept any electronic communication transmissions without proper authority; and violation of copyright, trademark, or defamation law.
2. In addition to illegal activities, the following email practices are expressly prohibited: entry, examination, use, transfer, and tampering with the accounts and files of others, unless appropriately authorized pursuant to this Policy; altering email system software or hardware configurations; or interfering with the work of others or with the University or other computing facilities.
3. University email will not be used for the following:
   1. commercial activities not approved by University supervisory personnel consistent with applicable policy;
   2. personal financial gain (except as permitted under University policies, including the Conflicts of Interest & Commitment Policy);
   3. any University Community member advocating for or against proposed legislation or Influencing the Outcome of Elections, as defined by the Political Activity Policy;
   4. personal use inconsistent with Section F of this Policy;
   5. uses that violate other University policies or guidelines, including, but not limited to, policies and guidelines regarding personnel, intellectual property, or discrimination and harassment; or
   6. uses inconsistent with applicable state or federal law.
4. University email will not be used for purposes that could reasonably be expected to cause, directly or indirectly, strain on any computing facilities or interference with others’ use of email. Such uses include, but are not limited to:
   1. Chain letters being sent or forwarded;
   2. Spam, meaning the exploitation of listservs or similar systems for the widespread distribution of unsolicited email; and
   3. Email bombs, meaning identical emails that are resent repeatedly to one or more recipients.

J. Confidentiality

1. The confidentiality of email cannot be assured. Therefore, users should exercise extreme caution in using email to communicate confidential personal, financial, or sensitive matters over the network, and should not assume that their email is private or confidential.
2. Users may not access, use, or disclose personal or confidential information without appropriate authorization, and must take necessary precautions to protect confidentiality of personal or confidential information, regardless of whether the information is maintained on paper or found in email or other electronic transmissions.

K. Records and Retention of Email

1. If an email is determined to be a Record of the University, as defined in the Record Retention and Destruction Policy, the email in its entirety (all metadata, attachments, distribution information, etc.) must be securely stored and retained for the proper period of time based on its assigned record series type found in the retention schedules used by the University. Once all retention guidelines have been met and the email Record no longer has any additional administrative, legal, research, or historical value, the email Record can be destroyed by following the proper record destruction procedures. For more information about record retention schedules or applicable email record guidelines, consult with the University Records Management Office. 

L. Violations

1. Suspected or known violations of this Policy or related laws should be reported to the appropriate supervisory level for the Unit in which the violation occurs or the Ethics and Compliance Hotline. Such violations will be processed by the appropriate University authorities, pursuant to applicable policies, and/or law enforcement agencies. If the violation involves an information security issue or requires technical assistance, the appropriate University official will engage the Information Security Office or University Information Technology Services as needed. Violations may result in academic dishonesty, code of conduct, or personnel proceedings; faculty, staff, or student disciplinary action; revocation of email privileges; referral to law enforcement agencies; or other legal action.