The Virtual Experience

In its contract with Harvard, Zoom accepted terms that protect the privacy of Harvard Zoom users. Most importantly, Harvard’s contract requires that Zoom "will not use Confidential Information for any purpose other than the performance of [Zoom] Services." Under the contract, "Confidential Information" includes:

• Personally identifiable information about any members of the Harvard community, as well as of "other individuals"; and
• Nonpublic information, whether about Harvard (including any unit within Harvard) or a third party, that Zoom knows or should know is confidential.

Harvard’s contract with Zoom imposes additional privacy and security commitments, including the obligation to comply with the Family Educational Rights and Privacy Act (FERPA).

It is important to note that these contract terms only apply to members of the Harvard community using a Harvard Zoom account.

Additional steps that Zoom has taken that the Harvard community should be aware of include:

• On March 29 Zoom amended its Privacy Policy to clarify its general practices regarding user privacy. Zoom's amended Privacy Policy provides that Zoom uses "customer content" only to "provide Zoom service to users." Under the Privacy Policy, "customer content" means "any information you upload, provide or create while using Zoom," specifically including "cloud recordings, chat/instant messages, files, whiteboard, and other information shared while using the service." Zoom may store customer content as needed to perform the services.

Zoom's amended Privacy Policy also distinguishes between information it collects through use of Zoom's services and information it collects from visitors to pages on its marketing sites. Only information collected from visitors to marketing sites is used by Zoom for marketing or promotional services or ad placement.

Harvard recognizes that Zoom has experienced remarkable growth in the last month and, with that, greater scrutiny of its privacy policy and security practices. A number of media reports have identified data privacy and client vulnerabilities in the Zoom platform. Steps Zoom has taken to address these vulnerabilities are recorded in release notes that Zoom publishes in its Zoom Help Center. Zoom also posts blogs to address concerns that are raised by its community.

"Zoombombing" occurs when uninvited attendees break into and disrupt your meeting. There have been reports of Zoombombing across higher education — including a small number of instances at Harvard, specifically—as Zoom usage has increased.

The best way to prevent against Zoombombing is to make sure your meetings are secure. Zoom recently updated its default settings to:

• Assign passcodes to new meetings*; and
• Restrict screen sharing to shares approved by the meeting host.

*Zoom has configured its passcodes so that meeting participants who receive invites and click links to meetings do not have to enter the passcode.  By contrast, uninvited participants who seek to enter a Zoom meeting by typing in the meeting number will need to enter a passcode before they are admitted.